Patch build version

2025-03-07 13:42:36 -06:00
2467 changed files with 242865 additions and 800000 deletions
@@ -1 +0,0 @@
-alt-blur@3076a2b5a593b0d7b37198b5aebfe3a222afd52d
@@ -1,9 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(pnpm typecheck *)",
-      "Bash(pnpm lint *)",
-      "Bash(pnpm test *)"
-    ]
-  }
-}
@@ -1,51 +1,8 @@
-# The env the app is running in e.g. development, testflight, production
-EXPO_PUBLIC_ENV=development
+# Copy this to `.env` and `.env.test` files

-# This is the semver release version of the app, pulled from package.json
-EXPO_PUBLIC_RELEASE_VERSION=
-
-# This is the commit hash that the current bundle was made from.
-EXPO_PUBLIC_BUNDLE_IDENTIFIER=
-
-# Should be formatted YYMMDDHH so that it increases for each build.
-EXPO_PUBLIC_BUNDLE_DATE=0
-
-# The log level for the app's logger transports
+BITDRIFT_API_KEY=
+SENTRY_AUTH_TOKEN=
 EXPO_PUBLIC_LOG_LEVEL=debug
-
-# Enable debug logs for specific logger instances
-EXPO_PUBLIC_LOG_DEBUG=session
-
-# Bluesky appview DID
-EXPO_PUBLIC_BLUESKY_PROXY_DID=
-
-# Chat service DID
-EXPO_PUBLIC_CHAT_PROXY_DID=
-
-#
-#
-# Bluesky specific values
-#
-#
-
-# Bluesky's metrics API
-EXPO_PUBLIC_METRICS_API_HOST=
-
-# Growthbook config
-EXPO_PUBLIC_GROWTHBOOK_API_HOST=
-EXPO_PUBLIC_GROWTHBOOK_CLIENT_KEY=
-
-# Sentry DSN for telemetry
-EXPO_PUBLIC_SENTRY_DSN=
-
-# Bitdrift API key. If undefined, Bitdrift will be disabled.
-EXPO_PUBLIC_BITDRIFT_API_KEY=
-
-# geolocation web worker URL
-GEOLOCATION_DEV_URL=
-
-# live-events web worker URL
-LIVE_EVENTS_DEV_URL=
-
-# app-config web worker URL
-APP_CONFIG_DEV_URL=
+EXPO_PUBLIC_LOG_DEBUG=
+EXPO_PUBLIC_BUNDLE_IDENTIFIER=
+EXPO_PUBLIC_BUNDLE_DATE=0
@@ -0,0 +1,108 @@
+module.exports = {
+  root: true,
+  extends: [
+    '@react-native',
+    'plugin:react/recommended',
+    'plugin:react/jsx-runtime',
+    'plugin:react-native-a11y/ios',
+    'prettier',
+  ],
+  parser: '@typescript-eslint/parser',
+  plugins: [
+    '@typescript-eslint',
+    'react',
+    'lingui',
+    'simple-import-sort',
+    'bsky-internal',
+    'eslint-plugin-react-compiler',
+  ],
+  rules: {
+    'react/no-unescaped-entities': 0,
+    'react/prop-types': 0,
+    'react-native/no-inline-styles': 0,
+    'bsky-internal/avoid-unwrapped-text': [
+      'error',
+      {
+        impliedTextComponents: [
+          'H1',
+          'H2',
+          'H3',
+          'H4',
+          'H5',
+          'H6',
+          'P',
+          'Admonition',
+          'Admonition.Admonition',
+        ],
+        impliedTextProps: [],
+        suggestedTextWrappers: {
+          Button: 'ButtonText',
+          'ToggleButton.Button': 'ToggleButton.ButtonText',
+        },
+      },
+    ],
+    'bsky-internal/use-exact-imports': 'error',
+    'bsky-internal/use-typed-gates': 'error',
+    'bsky-internal/use-prefixed-imports': 'error',
+    'simple-import-sort/imports': [
+      'error',
+      {
+        groups: [
+          // Side effect imports.
+          ['^\\u0000'],
+          // Node.js builtins prefixed with `node:`.
+          ['^node:'],
+          // Packages.
+          // Things that start with a letter (or digit or underscore), or `@` followed by a letter.
+          // React/React Native priortized, followed by expo
+          // Followed by all packages excluding unprefixed relative ones
+          [
+            '^(react\\/(.*)$)|^(react$)|^(react-native(.*)$)',
+            '^(expo(.*)$)|^(expo$)',
+            '^(?!(?:alf|components|lib|locale|logger|platform|screens|state|view)(?:$|\\/))@?\\w',
+          ],
+          // Relative imports.
+          // Ideally, anything that starts with a dot or #
+          // due to unprefixed relative imports being used, we whitelist the relative paths we use
+          // (?:$|\\/) matches end of string or /
+          [
+            '^(?:#\\/)?(?:lib|state|logger|platform|locale)(?:$|\\/)',
+            '^(?:#\\/)?view(?:$|\\/)',
+            '^(?:#\\/)?screens(?:$|\\/)',
+            '^(?:#\\/)?alf(?:$|\\/)',
+            '^(?:#\\/)?components(?:$|\\/)',
+            '^#\\/',
+            '^\\.',
+          ],
+          // anything else - hopefully we don't have any of these
+          ['^'],
+        ],
+      },
+    ],
+    'simple-import-sort/exports': 'error',
+    'react-compiler/react-compiler': 'warn',
+  },
+  ignorePatterns: [
+    '**/__mocks__/*.ts',
+    'src/platform/polyfills.ts',
+    'src/third-party',
+    'ios',
+    'android',
+    'coverage',
+    '*.lock',
+    '.husky',
+    'patches',
+    '*.html',
+    'bskyweb',
+    'bskyembed',
+    'src/locale/locales/_build/',
+    'src/locale/locales/**/*.js',
+  ],
+  settings: {
+    componentWrapperFunctions: ['observer'],
+  },
+  parserOptions: {
+    sourceType: 'module',
+    ecmaVersion: 'latest',
+  },
+}
@@ -1,5 +1,5 @@
 name: "Bug Report"
-description: "Create a report for an issue you have experienced in the app."
+description: "Create a report for an issue you have experience in the app."
 labels: ["bug"]
 body:
  - type: markdown
@@ -19,14 +19,13 @@ body:
        4. See error
    validations:
      required: true
-  - type: upload
+  - type: textarea
    attributes:
      label: Attachments
      description: |
        If possible, please provide any images or videos that may help us understand the issue you are experiencing.
    validations:
      required: false
-      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
  - type: dropdown
    attributes:
      label: What platform(s) does this occur on?
@@ -26,14 +26,13 @@ body:
        4. See error
    validations:
      required: true
-  - type: upload
+  - type: textarea
    attributes:
      label: Attachments
      description: |
        If possible, please provide any images or videos that may help us understand the issue you are experiencing.
    validations:
      required: false
-      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
  - type: dropdown
    attributes:
      label: What platform(s) does this occur on?
@@ -15,7 +15,7 @@ body:
        implement it in a timely manner.
    validations:
      required: true
-  - type: upload
+  - type: textarea
    attributes:
      label: Attachments
      description: |
@@ -24,7 +24,6 @@ body:
        in or is missing from.
    validations:
      required: false
-      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
  - type: textarea
    attributes:
      label: Describe Alternatives
@@ -1,15 +0,0 @@
---
-name: Compile translations
-description: Compile i18n translations and fail on compilation errors.
-
-runs:
-  using: composite
-  steps:
-    - name: 🔤 Compile translations
-      shell: bash
-      run: pnpm intl:build 2>&1 | tee i18n.log
-
-    - name: Check for i18n compilation errors
-      shell: bash
-      run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
-        errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
@@ -1,72 +0,0 @@
---
-name: Local EAS Build
-description: Build an Expo app locally with a selected EAS profile.
-
-inputs:
-  platform:
-    description: EAS platform to build (ios or android)
-    required: true
-  profile:
-    description: EAS build profile
-    required: true
-  output:
-    description: Output path for the local build artifact
-    required: true
-  log-path:
-    description: Optional path to tee build output into
-    required: false
-    default: ""
-  bump-build-number:
-    description: Run the build through use-build-number-with-bump
-    required: false
-    default: "false"
-  sentry-auth-token:
-    description: Optional Sentry authentication token
-    required: false
-    default: ""
-  sentry-release:
-    description: Optional Sentry release
-    required: false
-    default: ""
-  sentry-dist:
-    description: Optional Sentry distribution
-    required: false
-    default: ""
-
-runs:
-  using: composite
-  steps:
-    - name: Build locally with EAS
-      shell: bash
-      env:
-        PLATFORM: ${{ inputs.platform }}
-        PROFILE: ${{ inputs.profile }}
-        OUTPUT: ${{ inputs.output }}
-        LOG_PATH: ${{ inputs.log-path }}
-        BUMP_BUILD_NUMBER: ${{ inputs.bump-build-number }}
-        SENTRY_AUTH_TOKEN: ${{ inputs.sentry-auth-token }}
-        SENTRY_RELEASE: ${{ inputs.sentry-release }}
-        SENTRY_DIST: ${{ inputs.sentry-dist }}
-      run: |
-        set -o pipefail
-        build_command=(
-          pnpm eas build
-          --platform "$PLATFORM"
-          --profile "$PROFILE"
-          --local
-          --output "$OUTPUT"
-          --non-interactive
-        )
-
-        if [ -n "$LOG_PATH" ]; then
-          mkdir -p "$(dirname "$LOG_PATH")"
-          if [ "$BUMP_BUILD_NUMBER" = "true" ]; then
-            pnpm use-build-number-with-bump "${build_command[@]}" 2>&1 | tee "$LOG_PATH"
-          else
-            "${build_command[@]}" 2>&1 | tee "$LOG_PATH"
-          fi
-        elif [ "$BUMP_BUILD_NUMBER" = "true" ]; then
-          pnpm use-build-number-with-bump "${build_command[@]}"
-        else
-          "${build_command[@]}"
-        fi
@@ -1,50 +0,0 @@
---
-name: Setup denis CLI
-description: >
-  Download and verify the denis OTA publish binary from the (private)
-  bluesky-social/tango releases and put it on PATH. Uses a short-lived GitHub
-  App token scoped to contents:read on tango, since the default GITHUB_TOKEN
-  cannot read a private repo's releases.
-
-inputs:
-  release-tag:
-    description: denis release tag in bluesky-social/tango to download
-    required: true
-  app-id:
-    description: GitHub App ID for the token used to read tango releases
-    required: true
-  private-key:
-    description: GitHub App private key
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: 🔑 Mint tango read token
-      id: tango-token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      with:
-        app-id: ${{ inputs.app-id }}
-        private-key: ${{ inputs.private-key }}
-        repositories: tango
-        permission-contents: read
-
-    - name: ⬇️ Download and verify denis binary
-      shell: bash
-      env:
-        GH_TOKEN: ${{ steps.tango-token.outputs.token }}
-        RELEASE_TAG: ${{ inputs.release-tag }}
-      run: |
-        BIN_DIR="$RUNNER_TEMP/denis-bin"
-        mkdir -p "$BIN_DIR"
-        cd "$BIN_DIR"
-        gh release download "$RELEASE_TAG" \
-          --repo bluesky-social/tango \
-          --pattern denis-linux-amd64 \
-          --pattern denis-linux-amd64.sha256 \
-          --clobber
-        # Verify before making it executable / putting it on PATH.
-        sha256sum -c denis-linux-amd64.sha256
-        mv denis-linux-amd64 denis
-        chmod +x denis
-        echo "$BIN_DIR" >> "$GITHUB_PATH"
@@ -1,47 +0,0 @@
---
-name: Setup Expo Project
-description: Install dependencies and set up the Expo/EAS CLI for a build. Does not check out the repo.
-
-inputs:
-  expo-token:
-    description: Expo token (EXPO_TOKEN secret)
-    required: true
-  eas-version:
-    description: EAS CLI version to install
-    required: false
-    default: '19.0.5'
-
-runs:
-  using: composite
-  steps:
-    - name: Check for EXPO_TOKEN
-      shell: bash
-      env:
-        EXPO_TOKEN: ${{ inputs.expo-token }}
-      run: >
-        if [ -z "$EXPO_TOKEN" ]; then
-          echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
-          exit 1
-        fi
-
-    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-    - name: 🔧 Setup Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version-file: package.json
-        cache: pnpm
-
-    - name: 🪛 Setup jq
-      uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
-
-    - name: ⚙️ Install dependencies
-      shell: bash
-      run: pnpm install --frozen-lockfile
-
-    - name: 🔨 Setup Expo CLI
-      uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
-      with:
-        eas-version: ${{ inputs.eas-version }}
-        packager: 'pnpm --allow-build=dtrace-provider'
-        token: ${{ inputs.expo-token }}
@@ -1,63 +0,0 @@
---
-name: Write Environment Variables
-description: Write the .env file and google-services.json used by the build.
-
-inputs:
-  env-token:
-    description: Base .env contents (ENV_TOKEN secret)
-    required: true
-  sentry-dsn:
-    description: Sentry DSN (SENTRY_DSN secret)
-    required: true
-  bitdrift-api-key:
-    description: Bitdrift API key (BITDRIFT_API_KEY secret)
-    required: true
-  gcp-project-id:
-    description: GCP project ID (EXPO_PUBLIC_GCP_PROJECT_ID secret)
-    required: true
-  google-services-token:
-    description: google-services.json contents (GOOGLE_SERVICES_TOKEN secret)
-    required: true
-  expo-public-env:
-    description: >
-      EXPO_PUBLIC_ENV value. Only set for OTA deploys where eas.json isn't used;
-      for regular builds this is normally handled in eas.json.
-    required: false
-    default: ''
-
-outputs:
-  release-version:
-    description: Version from package.json
-    value: ${{ steps.env.outputs.release-version }}
-  bundle-identifier:
-    description: git SHA of HEAD
-    value: ${{ steps.env.outputs.bundle-identifier }}
-
-runs:
-  using: composite
-  steps:
-    - name: ✏️ Write environment variables
-      id: env
-      shell: bash
-      env:
-        ENV_TOKEN: ${{ inputs.env-token }}
-        SENTRY_DSN: ${{ inputs.sentry-dsn }}
-        BITDRIFT_API_KEY: ${{ inputs.bitdrift-api-key }}
-        GCP_PROJECT_ID: ${{ inputs.gcp-project-id }}
-        GOOGLE_SERVICES_TOKEN: ${{ inputs.google-services-token }}
-        EXPO_PUBLIC_ENV: ${{ inputs.expo-public-env }}
-      run: |
-        echo "$ENV_TOKEN" > .env
-        # EXPO_PUBLIC_ENV is normally handled in eas.json; only written here for OTA deploys.
-        if [ -n "$EXPO_PUBLIC_ENV" ]; then
-          echo "EXPO_PUBLIC_ENV=$EXPO_PUBLIC_ENV" >> .env
-        fi
-        echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
-        echo "release-version=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-        echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
-        echo "bundle-identifier=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-        echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-        echo "EXPO_PUBLIC_SENTRY_DSN=$SENTRY_DSN" >> .env
-        echo "EXPO_PUBLIC_BITDRIFT_API_KEY=$BITDRIFT_API_KEY" >> .env
-        echo "EXPO_PUBLIC_GCP_PROJECT_ID=$GCP_PROJECT_ID" >> .env
-        echo "$GOOGLE_SERVICES_TOKEN" > google-services.json
@@ -1,63 +0,0 @@
-You are an experienced senior React Native engineer reviewing a pull
-request in the Bluesky Social app — a cross-platform (iOS, Android, Web)
-React Native + Expo application. Read the repo's CLAUDE.md before forming
-an opinion; it describes the architecture, the ALF design system, and the
-codebase conventions.
-
-Your audience is other senior engineers. Write peer-to-peer, not
-teacher-to-junior. Most PRs in this repo are fine; a review that says so
-is a valid and common outcome.
-
-Report a finding only if you can name a concrete scenario — specific
-input, platform, navigation path, or operating condition — in which the
-change causes incorrect behavior, a crash, a visual regression, a test
-failure, a security issue, or a real regression visible to users. Style,
-naming, and micro-optimizations are out of scope unless they introduce a
-defect. Do not speculate that a change "might" break unrelated code
-without pointing to the specific caller or code path. Do not repeat what
-the diff does.
-
-Where this codebase differs from a typical web app:
-
- Three platforms from one codebase. Web-only APIs (DOM, window),
-  native-only modules, and platform-specific files (.web.tsx, .ios.tsx,
-  .android.tsx) are common sources of single-platform breakage. When a
-  change touches shared code, consider all three targets.
- User-facing strings must go through Lingui (the `Trans` macro /
-  `useLingui`). Hardcoded English strings in UI are a finding. Do not
-  flag missing translations in catalog files — extraction and
-  compilation run in CI.
- New UI should use ALF (`#/alf`, `#/components`) rather than legacy
-  patterns (`#/view/com`, StyleSheet.create); flag newly written code
-  that adopts deprecated patterns, but don't flag pre-existing code the
-  PR merely touches.
- Server state lives in TanStack Query under src/state/queries. Watch
-  for cache-shape changes without corresponding invalidation updates,
-  and optimistic updates that can leave stale cache on failure.
- List rendering is performance-critical (the main feed). Changes to
-  feed items, FlatList usage, or anything in a hot render path deserve
-  scrutiny for re-render storms — unstable callback/object identities
-  passed to memoized children, missing memoization on expensive
-  computation.
- Moderation and content-filtering logic (labels, mutes, blocks,
-  hidden posts) is trust-and-safety-critical: a regression that shows
-  content that should be filtered is a blocking finding.
- Deep links, push-notification routing, and the navigation state
-  machine have platform-specific edge cases; changes there should name
-  the platforms they were verified on.
- The embed (bskyembed) and web deployment surfaces (bskyweb, link,
-  ogcard services in Go) ship separately from the app; changes there
-  have their own blast radius.
-
-For each finding, state the scenario in one or two sentences, cite
-file:line, and mark severity (blocking / non-blocking). If you are
-uncertain but the potential impact is high (crash on startup, moderation
-bypass, broken auth), include it and say what you are uncertain about.
-Otherwise, prefer silence over guessing.
-
-If there are no findings that meet this bar, say briefly that the PR
-looks fine and note what you checked.
-
-Post your review as a single top-level PR comment. Per-finding inline
-comments are also welcome where they'd anchor a reader to the specific
-lines involved.
@@ -1,44 +0,0 @@
-version: 2
-# Dependabot auto-update config.
-#
-# Cooldown (7 days) is the point of this config: it delays version-update
-# PRs until a newly-published version has aged. Supply-chain attacks like
-# the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours
-# before the registry yanks them; a 7-day cooldown keeps poisoned
-# versions out of our lockfiles.
-#
-# Security updates bypass cooldown and continue to flow immediately. See:
-# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
-#
-# Auto-merge is deliberately NOT enabled. Every dependabot PR gets human
-# review.
-
-updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    cooldown:
-      default-days: 7
-    open-pull-requests-limit: 5
-    groups:
-      production:
-        dependency-type: production
-        update-types: [minor, patch]
-      development:
-        dependency-type: development
-        update-types: [minor, patch]
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    cooldown:
-      default-days: 7
-    open-pull-requests-limit: 3
-    groups:
-      actions:
-        patterns: ["*"]
-        update-types: [minor, patch]
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-set +e
-
-platform="${1:?usage: cleanup-nightly-e2e.sh <ios|android> <device-id>}"
-device_id="${2:-}"
-artifact_dir="${GITHUB_WORKSPACE:-$PWD}/artifacts/$platform"
-mkdir -p "$artifact_dir"
-
-if [[ -f i18n.log ]]; then
-  cp i18n.log "$artifact_dir/i18n.log"
-fi
-
-stop_process_tree() {
-  local pid="$1"
-  local child
-  while read -r child; do
-    [[ -n "$child" ]] && stop_process_tree "$child"
-  done < <(pgrep -P "$pid" 2>/dev/null || true)
-  kill -TERM "$pid" >/dev/null 2>&1 || true
-}
-
-stop_pid_file() {
-  [[ -f "$1" ]] || return 0
-  local pid
-  pid="$(cat "$1")"
-  stop_process_tree "$pid"
-}
-
-stop_pid_file "$artifact_dir/logcat.pid"
-stop_pid_file "$artifact_dir/metro.pid"
-stop_pid_file "$artifact_dir/mock-server.pid"
-stop_pid_file "$artifact_dir/emulator.pid"
-
-if [[ "$platform" == "ios" ]]; then
-  if [[ -f "$artifact_dir/redis-bin.txt" ]]; then
-    "$(cat "$artifact_dir/redis-bin.txt")/redis-cli" \
-      -h 127.0.0.1 -p 6380 shutdown nosave >/dev/null 2>&1 || true
-  fi
-  if [[ -f "$artifact_dir/postgres-bin.txt" ]]; then
-    "$(cat "$artifact_dir/postgres-bin.txt")/pg_ctl" \
-      -D "${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres" -m fast stop >/dev/null 2>&1 || true
-  fi
-  [[ -n "$device_id" ]] && xcrun simctl shutdown "$device_id" >/dev/null 2>&1 || true
-else
-  docker compose -f dev-env/dev-infra/docker-compose.yaml logs --no-color \
-    >>"$artifact_dir/docker-services.log" 2>&1 || true
-  docker compose -f dev-env/dev-infra/docker-compose.yaml down --volumes --remove-orphans >/dev/null 2>&1 || true
-  [[ -n "$device_id" ]] && adb -s "$device_id" emu kill >/dev/null 2>&1 || true
-fi
@@ -1,179 +0,0 @@
-#!/usr/bin/env bash
-
-set -Eeuo pipefail
-
-platform="${1:?usage: run-nightly-e2e.sh <ios|android> <device-id>}"
-device_id="${2:?usage: run-nightly-e2e.sh <ios|android> <device-id>}"
-
-if [[ "$platform" != "ios" && "$platform" != "android" ]]; then
-  echo "Unsupported platform: $platform" >&2
-  exit 2
-fi
-
-artifact_dir="${GITHUB_WORKSPACE:-$PWD}/artifacts/$platform"
-maestro_dir="$artifact_dir/maestro"
-mkdir -p "$maestro_dir"
-
-phase() {
-  printf '%s\n' "$1" >"$artifact_dir/phase.txt"
-}
-
-wait_for_port() {
-  local port="$1"
-  local label="$2"
-  local attempts="${3:-120}"
-
-  for ((i = 1; i <= attempts; i++)); do
-    if nc -z 127.0.0.1 "$port" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 1
-  done
-
-  echo "Timed out waiting for $label on port $port" >&2
-  return 1
-}
-
-# shellcheck disable=SC2329 # Invoked through the cleanup trap call chain.
-stop_process_tree() {
-  local pid="$1"
-  local child
-  while read -r child; do
-    [[ -n "$child" ]] && stop_process_tree "$child"
-  done < <(pgrep -P "$pid" 2>/dev/null || true)
-  kill -TERM "$pid" >/dev/null 2>&1 || true
-}
-
-# shellcheck disable=SC2329 # Invoked by cleanup, which is registered as a trap.
-stop_pid_file() {
-  local pid_file="$1"
-  [[ -f "$pid_file" ]] || return 0
-
-  local pid
-  pid="$(cat "$pid_file")"
-  [[ -n "$pid" ]] || return 0
-
-  # pnpm and Expo both spawn multiple generations of children.
-  stop_process_tree "$pid"
-}
-
-# shellcheck disable=SC2329 # Invoked by the EXIT/INT/TERM trap below.
-cleanup() {
-  set +e
-  stop_pid_file "$artifact_dir/logcat.pid"
-  stop_pid_file "$artifact_dir/metro.pid"
-  stop_pid_file "$artifact_dir/mock-server.pid"
-
-  if [[ "$platform" == "ios" ]]; then
-    if [[ -f "$artifact_dir/redis.pid" ]]; then
-      redis_bin="$(cat "$artifact_dir/redis-bin.txt")"
-      "$redis_bin/redis-cli" -h 127.0.0.1 -p 6380 shutdown nosave >/dev/null 2>&1 || true
-    fi
-    if [[ -f "$artifact_dir/postgres-bin.txt" && -d "${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres" ]]; then
-      postgres_bin="$(cat "$artifact_dir/postgres-bin.txt")"
-      "$postgres_bin/pg_ctl" -D "${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres" -m fast stop >/dev/null 2>&1 || true
-    fi
-  else
-    docker compose -f dev-env/dev-infra/docker-compose.yaml logs --no-color \
-      >>"$artifact_dir/docker-services.log" 2>&1 || true
-    docker compose -f dev-env/dev-infra/docker-compose.yaml down --volumes --remove-orphans >/dev/null 2>&1 || true
-  fi
-}
-
-trap cleanup EXIT INT TERM
-
-if [[ "$platform" == "android" ]]; then
-  adb -s "$device_id" logcat -c
-  adb -s "$device_id" logcat -v threadtime >"$artifact_dir/logcat.log" 2>&1 &
-  printf '%s\n' "$!" >"$artifact_dir/logcat.pid"
-fi
-
-phase "Starting PostgreSQL, Redis, and mock server"
-if [[ "$platform" == "ios" ]]; then
-  brew install postgresql@14 2>&1 | tee "$artifact_dir/native-dependencies.log"
-
-  postgres_bin="$(brew --prefix postgresql@14)/bin"
-  redis_version="7.4.7"
-  redis_archive="${RUNNER_TEMP:-/tmp}/redis-${redis_version}.tar.gz"
-  redis_source="${RUNNER_TEMP:-/tmp}/redis-${redis_version}"
-  curl -fsSL -o "$redis_archive" \
-    "https://download.redis.io/releases/redis-${redis_version}.tar.gz"
-  echo "c97e57b0df330a9e091cacff012bebe763c275398cf36ff44cdba876814b595b  $redis_archive" \
-    | shasum -a 256 --check | tee -a "$artifact_dir/native-dependencies.log"
-  rm -rf "$redis_source"
-  tar -xzf "$redis_archive" -C "${RUNNER_TEMP:-/tmp}"
-  make -C "$redis_source" -j "$(sysctl -n hw.ncpu)" \
-    2>&1 | tee -a "$artifact_dir/native-dependencies.log"
-  redis_bin="$redis_source/src"
-  "$redis_bin/redis-server" --version | tee -a "$artifact_dir/native-dependencies.log"
-  printf '%s\n' "$redis_bin" >"$artifact_dir/redis-bin.txt"
-
-  postgres_data="${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres"
-  rm -rf "$postgres_data"
-  "$postgres_bin/initdb" -D "$postgres_data" --auth=trust --username=pg --no-locale \
-    >"$artifact_dir/postgres-init.log" 2>&1
-  "$postgres_bin/pg_ctl" -D "$postgres_data" \
-    -o "-p 5433 -h 127.0.0.1" -l "$artifact_dir/postgres.log" start
-  printf '%s\n' "$postgres_bin" >"$artifact_dir/postgres-bin.txt"
-
-  "$redis_bin/redis-server" \
-    --bind 127.0.0.1 \
-    --port 6380 \
-    --save "" \
-    --appendonly no \
-    --daemonize yes \
-    --pidfile "$artifact_dir/redis.pid" \
-    --logfile "$artifact_dir/redis.log"
-
-  wait_for_port 5433 "PostgreSQL"
-  wait_for_port 6380 "Redis"
-  pnpm --dir dev-env start:external >"$artifact_dir/mock-server.log" 2>&1 &
-else
-  pnpm --dir dev-env start >"$artifact_dir/mock-server.log" 2>&1 &
-fi
-printf '%s\n' "$!" >"$artifact_dir/mock-server.pid"
-wait_for_port 1986 "the E2E mock-server manager"
-
-phase "Starting Metro"
-EXPO_PUBLIC_ENV=e2e \
-  NODE_ENV=development \
-  RN_SRC_EXT=e2e.ts,e2e.tsx \
-  pnpm exec expo start --dev-client --clear --port 8081 \
-  >"$artifact_dir/metro.log" 2>&1 &
-printf '%s\n' "$!" >"$artifact_dir/metro.pid"
-wait_for_port 8081 "Metro"
-
-# Pre-warm Metro bundle so the first Maestro flow doesn't hit a cold-start delay
-phase "Pre-warming Metro bundle"
-bundle_platform="$platform"
-curl -s -o /dev/null "http://localhost:8081/index.bundle?platform=${bundle_platform}&dev=true&minify=false"
-echo "Metro bundle pre-warmed for $bundle_platform"
-
-if [[ "$platform" == "android" ]]; then
-  phase "Configuring Android localhost routing"
-  adb -s "$device_id" reverse tcp:3000 tcp:3000
-  adb -s "$device_id" reverse tcp:8081 tcp:8081
-fi
-
-phase "Running Maestro flows"
-set +e
-maestro test \
-  --udid "$device_id" \
-  --format JUNIT \
-  --output "$artifact_dir/report.xml" \
-  --config __e2e__/config.yml \
-  --debug-output "$maestro_dir" \
-  --test-output-dir "$maestro_dir" \
-  --flatten-debug-output \
-  __e2e__ \
-  2>&1 | tee "$artifact_dir/maestro-cli.log"
-maestro_status=${PIPESTATUS[0]}
-set -e
-
-if [[ "$maestro_status" -eq 0 ]]; then
-  phase "Completed"
-else
-  phase "Maestro flow failure"
-fi
-
-exit "$maestro_status"
@@ -1,356 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import process from 'node:process'
-
-const ENTITY_REPLACEMENTS = {
-  '&amp;': '&',
-  '&apos;': "'",
-  '&gt;': '>',
-  '&lt;': '<',
-  '&quot;': '"',
-}
-
-function decodeXml(value = '') {
-  return value
-    .replace(/&(amp|apos|gt|lt|quot);/g, entity => ENTITY_REPLACEMENTS[entity])
-    .replace(/&#(\d+);/g, (_, code) => String.fromCodePoint(Number(code)))
-    .replace(/&#x([\da-f]+);/gi, (_, code) =>
-      String.fromCodePoint(Number.parseInt(code, 16)),
-    )
-}
-
-function attributes(source = '') {
-  const result = {}
-  for (const match of source.matchAll(/([\w:.-]+)\s*=\s*(["'])(.*?)\2/gs)) {
-    result[match[1]] = decodeXml(match[3])
-  }
-  return result
-}
-
-function concise(value, limit = 300) {
-  const normalized = decodeXml(value)
-    .replace(/<[^>]+>/g, ' ')
-    .replace(/\s+/g, ' ')
-    .trim()
-  return normalized.length > limit
-    ? `${normalized.slice(0, limit - 1)}…`
-    : normalized
-}
-
-export function parseJUnit(xml) {
-  const failures = []
-  const testcasePattern = /<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/gi
-
-  for (const match of xml.matchAll(testcasePattern)) {
-    const testcase = attributes(match[1])
-    const body = match[2] || ''
-    const failure = body.match(/<(failure|error)\b([^>]*)>([\s\S]*?)<\/\1>/i)
-    const selfClosingFailure = body.match(/<(failure|error)\b([^>]*)\/>/i)
-    const failureMatch = failure || selfClosingFailure
-    if (!failureMatch) continue
-
-    const failureAttributes = attributes(failureMatch[2])
-    const name = testcase.name || testcase.classname || 'Unnamed Maestro flow'
-    const message = concise(
-      failureAttributes.message || (failure ? failureMatch[3] : '') || 'Failed',
-    )
-    failures.push({name, message})
-  }
-
-  if (failures.length === 0) {
-    const suite = xml.match(/<testsuite\b([^>]*)>/i)
-    const suiteAttributes = attributes(suite?.[1])
-    if (
-      Number(suiteAttributes.failures || 0) +
-        Number(suiteAttributes.errors || 0) >
-      0
-    ) {
-      failures.push({
-        name: suiteAttributes.name || 'Maestro test suite',
-        message: 'JUnit reported a failure without testcase details',
-      })
-    }
-  }
-
-  return failures
-}
-
-export function parseMaestroCli(log) {
-  const failures = []
-  const failurePattern = /^\[Failed\]\s+(.+?)\s+\([^)]*\)\s+\((.+)\)\s*$/gm
-  for (const match of log.matchAll(failurePattern)) {
-    failures.push({
-      name: concise(match[1], 120),
-      message: concise(match[2]),
-    })
-  }
-  return failures
-}
-
-function walk(root) {
-  if (!root || !fs.existsSync(root)) return []
-  const entries = fs.readdirSync(root, {withFileTypes: true})
-  return entries.flatMap(entry => {
-    const candidate = path.join(root, entry.name)
-    return entry.isDirectory() ? walk(candidate) : [candidate]
-  })
-}
-
-function readPhase(root) {
-  const phaseFile = walk(root).find(file => path.basename(file) === 'phase.txt')
-  return phaseFile ? fs.readFileSync(phaseFile, 'utf8').trim() : ''
-}
-
-function platformResult({name, status, root, artifactUrl}) {
-  const files = walk(root)
-  const reports = files.filter(file => /(?:report|junit).*\.xml$/i.test(file))
-  const junitFailures = reports.flatMap(report =>
-    parseJUnit(fs.readFileSync(report, 'utf8')),
-  )
-  const maestroLogs = files.filter(
-    file => path.basename(file) === 'maestro-cli.log',
-  )
-  const cliFailures = maestroLogs.flatMap(log =>
-    parseMaestroCli(fs.readFileSync(log, 'utf8')),
-  )
-  // A cancelled or timed-out Maestro run may never flush JUnit. Its CLI log is
-  // streamed continuously, so use those failure lines when JUnit has no detail.
-  const failures = junitFailures.length > 0 ? junitFailures : cliFailures
-  // A skipped platform (e.g. iOS while temporarily disabled) is not a failure
-  // as long as it produced no flow failures.
-  const failed =
-    (status !== 'success' && status !== 'skipped') || failures.length > 0
-  return {
-    name,
-    status,
-    failed,
-    failures,
-    phase: readPhase(root),
-    hasJUnit: reports.length > 0,
-    artifactUrl,
-  }
-}
-
-function statusEmoji(status) {
-  if (status === 'success') return ':white_check_mark:'
-  if (status === 'skipped') return ':fast_forward:'
-  return ':x:'
-}
-
-function slackEscape(value) {
-  return value
-    .replaceAll('&', '&amp;')
-    .replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;')
-}
-
-function platformBlock(platform) {
-  const lines = [
-    `${statusEmoji(platform.status)} *${platform.name}* — job status: \`${platform.status}\``,
-  ]
-  if (platform.failures.length > 0) {
-    for (const failure of platform.failures.slice(0, 8)) {
-      lines.push(
-        `• *${slackEscape(failure.name)}:* ${slackEscape(failure.message)}`,
-      )
-    }
-    if (platform.failures.length > 8) {
-      lines.push(`• …and ${platform.failures.length - 8} more failed flows`)
-    }
-  } else if (platform.failed && !platform.hasJUnit) {
-    lines.push(
-      `• *Setup phase:* ${slackEscape(platform.phase || 'No phase metadata was captured')}`,
-    )
-  } else if (platform.failed) {
-    lines.push(
-      `• Job failed after JUnit was written; latest phase: ${slackEscape(platform.phase || 'unknown')}`,
-    )
-  }
-  if (platform.artifactUrl) {
-    lines.push(
-      `• <${platform.artifactUrl}|Open ${platform.name} logs and artifacts>`,
-    )
-  }
-  return lines.join('\n').slice(0, 3000)
-}
-
-function githubSummary({notify, platforms, shortSha, runUrl, commitUrl}) {
-  const lines = [
-    `# Nightly Maestro E2E ${notify ? 'failed' : 'passed'}`,
-    '',
-    `- Commit: [\`${shortSha}\`](${commitUrl})`,
-    `- Workflow run: [open run](${runUrl})`,
-    '',
-  ]
-
-  for (const platform of platforms) {
-    const headerEmoji =
-      platform.status === 'success'
-        ? '✅'
-        : platform.status === 'skipped'
-          ? '⏭️'
-          : '❌'
-    lines.push(
-      `## ${headerEmoji} ${platform.name}`,
-      '',
-      `Job status: \`${platform.status}\``,
-      '',
-    )
-    if (platform.failures.length > 0) {
-      for (const failure of platform.failures.slice(0, 10)) {
-        lines.push(`- **${failure.name}:** ${failure.message}`)
-      }
-      if (platform.failures.length > 10) {
-        lines.push(`- …and ${platform.failures.length - 10} more failed flows`)
-      }
-      lines.push('')
-    } else if (platform.failed && !platform.hasJUnit) {
-      lines.push(
-        `- Setup phase: ${platform.phase || 'No phase metadata was captured'}`,
-        '',
-      )
-    } else if (platform.failed) {
-      lines.push(
-        `- The job failed after JUnit was written (latest phase: ${platform.phase || 'unknown'})`,
-        '',
-      )
-    }
-    if (platform.artifactUrl) {
-      lines.push(
-        `- [${platform.name} logs and artifacts](${platform.artifactUrl})`,
-        '',
-      )
-    }
-  }
-
-  return lines.join('\n').trim()
-}
-
-export function buildSummary({
-  iosStatus,
-  androidStatus,
-  iosRoot,
-  androidRoot,
-  artifactUrls = {},
-  sha,
-  runUrl,
-  commitUrl,
-}) {
-  const platforms = [
-    platformResult({
-      name: 'iOS',
-      status: iosStatus,
-      root: iosRoot,
-      artifactUrl: artifactUrls.ios,
-    }),
-    platformResult({
-      name: 'Android',
-      status: androidStatus,
-      root: androidRoot,
-      artifactUrl: artifactUrls.android,
-    }),
-  ]
-  const notify = platforms.some(platform => platform.failed)
-  const shortSha = sha.slice(0, 12)
-  const lines = [
-    ':rotating_light: *Nightly Maestro E2E failed*',
-    `*Commit:* <${commitUrl}|\`${shortSha}\`>`,
-    `*Workflow run:* <${runUrl}|open run>`,
-    '',
-  ]
-
-  for (const platform of platforms) {
-    lines.push(
-      `${statusEmoji(platform.status)} *${platform.name}* — job status: \`${platform.status}\``,
-    )
-    if (platform.failures.length > 0) {
-      for (const failure of platform.failures.slice(0, 10)) {
-        lines.push(
-          `• *${slackEscape(failure.name)}:* ${slackEscape(failure.message)}`,
-        )
-      }
-      if (platform.failures.length > 10) {
-        lines.push(`• …and ${platform.failures.length - 10} more failed flows`)
-      }
-    } else if (platform.failed && !platform.hasJUnit) {
-      lines.push(
-        `• Setup phase: ${platform.phase || 'No phase metadata was captured'}`,
-      )
-    } else if (platform.failed) {
-      lines.push(
-        `• The job failed after JUnit was written (latest phase: ${platform.phase || 'unknown'})`,
-      )
-    }
-    if (platform.artifactUrl) {
-      lines.push(
-        `• <${platform.artifactUrl}|${platform.name} logs and artifacts>`,
-      )
-    }
-    lines.push('')
-  }
-
-  const text = lines.join('\n').trim()
-  const blocks = [
-    {
-      type: 'header',
-      text: {type: 'plain_text', text: 'Nightly Maestro E2E failed'},
-    },
-    {
-      type: 'section',
-      text: {
-        type: 'mrkdwn',
-        text: `*Commit:* <${commitUrl}|\`${shortSha}\`>\n*Workflow run:* <${runUrl}|open run>`,
-      },
-    },
-    {type: 'divider'},
-    ...platforms.flatMap((platform, index) => [
-      {type: 'section', text: {type: 'mrkdwn', text: platformBlock(platform)}},
-      ...(index < platforms.length - 1 ? [{type: 'divider'}] : []),
-    ]),
-  ]
-  return {
-    notify,
-    platforms,
-    githubSummary: githubSummary({
-      notify,
-      platforms,
-      shortSha,
-      runUrl,
-      commitUrl,
-    }),
-    payload: {text, blocks},
-  }
-}
-
-function parseArgs(argv) {
-  const result = {}
-  for (let i = 0; i < argv.length; i += 2) {
-    const key = argv[i]
-    if (!key?.startsWith('--') || argv[i + 1] === undefined) {
-      throw new Error(`Invalid argument: ${key || '<missing>'}`)
-    }
-    result[key.slice(2)] = argv[i + 1]
-  }
-  return result
-}
-
-if (
-  process.argv[1] &&
-  path.resolve(process.argv[1]) === path.resolve(import.meta.filename)
-) {
-  const args = parseArgs(process.argv.slice(2))
-  const artifactUrls = args['artifact-urls']
-    ? JSON.parse(fs.readFileSync(args['artifact-urls'], 'utf8'))
-    : {}
-  const summary = buildSummary({
-    iosStatus: args['ios-status'],
-    androidStatus: args['android-status'],
-    iosRoot: args['ios-root'],
-    androidRoot: args['android-root'],
-    artifactUrls,
-    sha: args.sha,
-    runUrl: args['run-url'],
-    commitUrl: args['commit-url'],
-  })
-  process.stdout.write(`${JSON.stringify(summary)}\n`)
-}
@@ -21,37 +21,35 @@ jobs:
      id-token: write

    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout repository
+        uses: actions/checkout@v3

-      - name: 🔧 Setup Docker buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1

-      - name: 🔑 Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
          password: ${{ env.PASSWORD }}

-      - name: 🏷️ Extract Docker metadata
+      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,enable=true,priority=100,prefix=,suffix=,format=long

-      - name: 📝 Env
-        id: env
-        run: |
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+      - name: Set outputs
+        id: vars
+        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

-      - name: 🚀 Build and push Docker image
+      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -61,8 +59,4 @@ jobs:
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
-            EXPO_PUBLIC_ENV=production
-            EXPO_PUBLIC_RELEASE_VERSION=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-            EXPO_PUBLIC_BUNDLE_IDENTIFIER=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-            EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-            SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+            EXPO_PUBLIC_BUNDLE_IDENTIFIER=${{ steps.vars.outputs.sha_short }}
@@ -22,31 +22,31 @@ jobs:
      id-token: write

    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout repository
+        uses: actions/checkout@v3

-      - name: 🔧 Setup Docker buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1

-      - name: 🔑 Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME }}
          password: ${{ env.PASSWORD }}

-      - name: 🏷️ Extract Docker metadata
+      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,enable=true,priority=100,prefix=bskyweb:,suffix=,format=long

-      - name: 🚀 Build and push Docker image
+      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -3,7 +3,6 @@ on:
  push:
    branches:
      - main
-      - echoprom_fix

 env:
  REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -21,31 +20,31 @@ jobs:
      id-token: write

    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout repository
+        uses: actions/checkout@v3

-      - name: 🔧 Setup Docker buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1

-      - name: 🔑 Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
          password: ${{ env.PASSWORD }}

-      - name: 🏷️ Extract Docker metadata
+      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,enable=true,priority=100,prefix=,suffix=,format=long

-      - name: 🚀 Build and push Docker image
+      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -1,9 +1,6 @@
 name: build-and-push-link-aws
 on:
  workflow_dispatch:
-  push:
-    branches:
-      - main

 env:
  REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -21,34 +18,34 @@ jobs:
      id-token: write

    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout repository
+        uses: actions/checkout@v3

-      - name: 🔧 Setup Docker buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1

-      - name: 🔑 Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
          password: ${{ env.PASSWORD }}

-      - name: 🏷️ Extract Docker metadata
+      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,enable=true,priority=100,prefix=,suffix=,format=long

-      - name: 🚀 Build and push Docker image
+      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@v4
        with:
          context: .
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
          file: ./Dockerfile.bskylink
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -1,9 +1,6 @@
 name: build-and-push-ogcard-aws
 on:
  workflow_dispatch:
-  push:
-    branches:
-      - main

 env:
  REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -21,34 +18,34 @@ jobs:
      id-token: write

    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout repository
+        uses: actions/checkout@v3

-      - name: 🔧 Setup Docker buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1

-      - name: 🔑 Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
          password: ${{ env.PASSWORD }}

-      - name: 🏷️ Extract Docker metadata
+      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,enable=true,priority=100,prefix=,suffix=,format=long

-      - name: 🚀 Build and push Docker image
+      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@v4
        with:
          context: .
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
          file: ./Dockerfile.bskyogcard
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -10,298 +10,158 @@ on:
        options:
          - testflight-android
          - production
-      submit:
-        type: boolean
-        description: Submit the build to Google Play (disable to only produce the APK artifact)
-        default: true
-  workflow_call:
-    inputs:
-      profile:
-        type: string
-        description: Build profile to use
-        required: true
-      submit:
-        type: boolean
-        description: Submit the build to Google Play (disable to only produce the APK artifact)
-        default: true
-      runner:
-        type: string
-        description: Runner for the build job (defaults to Linux-x64-32core)
-        required: false
-        default: ''
-    outputs:
-      package-version:
-        description: Version from package.json
-        value: ${{ jobs.build.outputs.package-version }}
-      version-code:
-        description: Android version code
-        value: ${{ jobs.build.outputs.version-code }}
-    secrets:
-      EXPO_TOKEN:
-        required: true
-      ENV_TOKEN:
-        required: true
-      SENTRY_DSN:
-        required: true
-      BITDRIFT_API_KEY:
-        required: true
-      EXPO_PUBLIC_GCP_PROJECT_ID:
-        required: true
-      GOOGLE_SERVICES_TOKEN:
-        required: true
-      SENTRY_AUTH_TOKEN:
-        required: true
-      SLACK_CLIENT_ALERT_WEBHOOK:
-        required: true
-      ANDROID_KEYSTORE_BASE64:
-        required: true
-      ANDROID_KEYSTORE_PASSWORD:
-        required: true
-      ANDROID_KEY_ALIAS:
-        required: true
-      ANDROID_KEY_PASSWORD:
-        required: true
-
-# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
-permissions:
-  contents: read

 jobs:
  build:
-    if: github.repository == 'bluesky-social/social-app'
-    name: Build Android
-    runs-on: ${{ inputs.runner || 'Linux-x64-32core' }}
-    concurrency:
-      group: android-build
-      cancel-in-progress: false
-    outputs:
-      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
-      version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+    name: Build and Submit Android
+    runs-on: ubuntu-latest
    steps:
+      - name: Check for EXPO_TOKEN
+        run: >
+          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
+            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
+            exit 1
+          fi
+
      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v4
        with:
          fetch-depth: 5

-      - name: 🔧 Setup Expo project
-        uses: ./.github/actions/setup-expo-project
+      - name: 🔧 Setup Node
+        uses: actions/setup-node@v4
        with:
-          expo-token: ${{ secrets.EXPO_TOKEN }}
+          node-version-file: .nvmrc
+          cache: yarn

-      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+      - name: 🪛 Setup jq
+        uses: dcarbone/install-jq-action@v2
+
+      - name: 🔨 Setup EAS
+        uses: expo/expo-github-action@v8
        with:
-          distribution: "temurin"
-          java-version: "17"
+          expo-version: latest
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: ⛏️ Setup EAS local builds
+        run: yarn global add eas-cli-local-build-plugin
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - name: ⚙️ Install dependencies
+        run: yarn install

      - name: 🔤 Compile translations
-        uses: ./.github/actions/compile-i18n
+        run: yarn intl:build

-      # EXPO_PUBLIC_ENV is handled in eas.json
      - name: ✏️ Write environment variables
-        id: env
-        uses: ./.github/actions/write-env
-        with:
-          env-token: ${{ secrets.ENV_TOKEN }}
-          sentry-dsn: ${{ secrets.SENTRY_DSN }}
-          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
-          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+        run: |
+          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
+          echo "${{ secrets.ENV_TOKEN }}" > .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
+          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "$json" > google-services.json

      - name: 🏗️ EAS Build
-        uses: ./.github/actions/eas-local-build
-        with:
-          platform: android
-          profile: ${{ inputs.profile || 'testflight-android' }}
-          output: build.aab
-          bump-build-number: "true"
-          sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          sentry-release: ${{ steps.env.outputs.release-version }}
-          sentry-dist: ${{ steps.env.outputs.bundle-identifier }}
+        run: yarn use-build-number-with-bump eas build -p android --profile ${{ inputs.profile || 'testflight-android' }} --local --output build.aab --non-interactive

-      - name: 📚 Get version from package.json
-        id: get-build-info
-        run: bash scripts/setGitHubOutput.sh
-
-      # Hands the built bundle off to the submit / universalApk jobs. Retention is
-      # deliberately short (1 day) since it's only an intra-run handoff artifact.
-      - name: 🚀 Upload AAB artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: android-aab-${{ github.run_id }}
-          retention-days: 1
-          if-no-files-found: error
-          path: build.aab
-
-  submit:
-    name: Submit to Google Play
-    runs-on: ubuntu-latest
-    needs: [build]
-    # Submit unless explicitly disabled; on events where inputs is empty this still submits.
-    if: ${{ inputs.submit != false }}
-    steps:
-      # eas submit reads app config from the repo, so we need a checkout.
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 5
-
-      - name: 🔧 Setup Expo project
-        uses: ./.github/actions/setup-expo-project
-        with:
-          expo-token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⬇️ Download AAB artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: android-aab-${{ github.run_id }}
-
-      - name: 🚀 Submit to Google Play
-        env:
-          PROFILE: ${{ inputs.profile || 'testflight-android' }}
-        run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab
-
-      - name: 🔔 Notify Slack of Play Store Submission
-        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
-        with:
-          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload-templated: true
-          payload: |
-            {"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
-
-  # Runs in parallel with submit: the QA APK shouldn't be blocked by a Play submission failure.
-  universalApk:
-    name: Build universal APK
-    runs-on: ubuntu-latest
-    needs: [build]
-    outputs:
-      apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
-    steps:
-      - name: ⬇️ Download AAB artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: android-aab-${{ github.run_id }}
-
-      # bundletool needs a JRE. ubuntu-latest ships a default JDK, but pin it explicitly
-      # like the build job so the toolchain is deterministic.
-      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
-        with:
-          distribution: "temurin"
-          java-version: "17"
-
-      - name: 🔧 Setup bundletool
-        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
-        with:
-          version: "1.18.3"
-
-      - name: 🔑 Decode keystore
-        env:
-          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-        run: echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > keystore.jks
-
-      - name: 📦 Build signed universal APK
-        env:
-          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
-          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
-        run: |
-          bundletool build-apks \
-            --bundle=build.aab \
-            --output=universal.apks \
-            --mode=universal \
-            --ks=keystore.jks \
-            --ks-pass=pass:"$ANDROID_KEYSTORE_PASSWORD" \
-            --ks-key-alias="$ANDROID_KEY_ALIAS" \
-            --key-pass=pass:"$ANDROID_KEY_PASSWORD"
-
-      - name: 📋 Rename to .zip for extraction
-        run: mv universal.apks universal.zip
-
-      - name: 📦 Extract universal APK
-        run: unzip -p universal.zip universal.apk > build.apk
+      - name: ✍️ Rename Testflight bundle
+        if: ${{ inputs.profile != 'production' }}
+        run: mv build.aab build.apk

      - name: ⏰ Get a timestamp
        id: timestamp
-        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
+        uses: nanzm/get-time-action@master
+        with:
+          format: 'MM-DD-HH-mm-ss'

-      - name: 🚀 Upload APK Artifact
-        id: upload-artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - name: 🚀 Upload Production Artifact
+        id: upload-artifact-production
+        if: ${{ inputs.profile == 'production' }}
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 30
+          compression-level: 6
+          name: build-${{ steps.timestamp.outputs.time }}.aab
+          path: build.aab
+
+      - name: 🚀 Upload Testflight Artifact
+        id: upload-artifact-testflight
+        if: ${{ inputs.profile != 'production' }}
+        uses: actions/upload-artifact@v4
        with:
          retention-days: 30
          compression-level: 6
          name: build-${{ steps.timestamp.outputs.time }}.apk
          path: build.apk

-      - name: 🔔 Notify Slack of APK Artifact
-        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
+      - name: 📚 Get version from package.json
+        id: get-build-info
+        run: bash scripts/setGitHubOutput.sh
+
+      - name: 🔔 Notify Slack of Production Build
+        if: ${{ inputs.profile == 'production' }}
+        uses: slackapi/slack-github-action@v1.25.0
        with:
-          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload-templated: true
          payload: |
-            {"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
-
-  # Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
-  # build is dispatched against such a tag we attach the APK to the matching release. This runs
-  # as a separate job so that `contents: write` is isolated here and the build job stays read-only.
-  attachToRelease:
-    name: Attach APK to GitHub Release
-    runs-on: ubuntu-latest
-    needs: [build, universalApk]
-    if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
-    permissions:
-      contents: write
-    steps:
-      # We only attach to a release that already exists — never create one.
-      - name: 🔎 Check for matching GitHub Release
-        id: release-check
+            {
+              "text": "Android production build for Google Play Store submission is ready!\n```Artifact: ${{ steps.upload-artifact-production.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"
+            }
        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          status=$(curl -sS -o /dev/null -w '%{http_code}' \
-            -H "Authorization: Bearer $GH_TOKEN" \
-            -H "Accept: application/vnd.github+json" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
-          if [ "$status" = "200" ]; then
-            echo "Found GitHub Release for tag $TAG"
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-          fi
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

-      - name: ⬇️ Download APK artifact
-        if: ${{ steps.release-check.outputs.exists == 'true' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - name: 🔔 Notify Slack of Testflight Build
+        if: ${{ inputs.profile != 'production' }}
+        uses: slackapi/slack-github-action@v1.25.0
        with:
-          name: ${{ needs.universalApk.outputs.apk-artifact-name }}
-
-      - name: 🏷️ Rename APK for release
-        if: ${{ steps.release-check.outputs.exists == 'true' }}
-        run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"
-
-      - name: 📎 Attach APK to GitHub Release
-        id: attach
-        if: ${{ steps.release-check.outputs.exists == 'true' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          TAG: ${{ github.ref_name }}
-          APK: Bluesky-${{ needs.build.outputs.package-version }}.apk
-        run: |
-          gh release upload "$TAG" "$APK" --clobber
-          url=$(gh release view "$TAG" --json url --jq .url)
-          echo "url=$url" >> "$GITHUB_OUTPUT"
-
-      - name: 🔔 Notify Slack of Release Attachment
-        if: ${{ steps.release-check.outputs.exists == 'true' }}
-        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
-        with:
-          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload-templated: true
          payload: |
-            {"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}
+            {
+              "text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact-testflight.outputs.artifact-url }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+
+      - name: 🏗️ Build Production APK
+        if: ${{ inputs.profile == 'production' }}
+        run: yarn use-build-number-with-bump eas build -p android --profile production-apk --local --output build.apk --non-interactive
+
+      - name: 🚀 Upload Production APK Artifact
+        id: upload-artifact-production-apk
+        if: ${{ inputs.profile == 'production' }}
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 30
+          compression-level: 6
+          name: build-${{ steps.timestamp.outputs.time }}.apk
+          path: build.apk
+
+      - name: 🔔 Notify Slack of Production APK Build
+        if: ${{ inputs.profile == 'production' }}
+        uses: slackapi/slack-github-action@v1.25.0
+        with:
+          payload: |
+            {
+              "text": "Android production build for GitHub/Obtanium is ready!\n```Artifact: ${{ steps.upload-artifact-production-apk.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+
+      - name: ⬇️ Restore Cache
+        id: get-base-commit
+        uses: actions/cache@v4
+        if: ${{ inputs.profile == 'testflight' }}
+        with:
+          path: most-recent-testflight-commit.txt
+          key: most-recent-testflight-commit
+
+      - name: ✏️ Write commit hash to cache
+        if: ${{ inputs.profile == 'testflight' }}
+        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
@@ -10,292 +10,105 @@ on:
        options:
          - testflight
          - production
-      testFlightGroup:
-        type: choice
-        description: TestFlight group to assign the build to after submitting
-        options:
-          - none
-          - QA Team
-          - Software Mansion
-        default: none
-  workflow_call:
-    inputs:
-      profile:
-        type: string
-        description: Build profile to use
-        required: true
-      testFlightGroup:
-        type: string
-        description: TestFlight group to assign the build to after submitting ("none" to skip)
-        default: none
-      runner:
-        type: string
-        description: Runner for the build job (defaults to macos-26-xlarge)
-        required: false
-        default: ''
-    outputs:
-      package-version:
-        description: Version from package.json
-        value: ${{ jobs.build.outputs.package-version }}
-      build-number:
-        description: iOS build number
-        value: ${{ jobs.build.outputs.build-number }}
-    secrets:
-      EXPO_TOKEN:
-        required: true
-      ENV_TOKEN:
-        required: true
-      SENTRY_DSN:
-        required: true
-      BITDRIFT_API_KEY:
-        required: true
-      EXPO_PUBLIC_GCP_PROJECT_ID:
-        required: true
-      GOOGLE_SERVICES_TOKEN:
-        required: true
-      SENTRY_AUTH_TOKEN:
-        required: true
-      ASC_KEY_ID:
-        required: true
-      ASC_ISSUER_ID:
-        required: true
-      ASC_KEY_P8_BASE64:
-        required: true
-      SLACK_CLIENT_ALERT_WEBHOOK:
-        required: true
-
-# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
-permissions:
-  contents: read

 jobs:
  build:
-    if: github.repository == 'bluesky-social/social-app'
-    name: Build iOS
-    runs-on: ${{ inputs.runner || 'macos-26-xlarge' }}
-    concurrency:
-      group: ios-build
-      cancel-in-progress: false
-    outputs:
-      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
-      build-number: ${{ steps.ipa-build-number.outputs.build-number }}
+    name: Build and Submit iOS
+    runs-on: macos-15
    steps:
+      - name: Check for EXPO_TOKEN
+        run: >
+          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
+            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
+            exit 1
+          fi
+
      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v4
        with:
          fetch-depth: 5

-      - name: 🔧 Setup Expo project
-        uses: ./.github/actions/setup-expo-project
+      - name: 🔧 Setup Node
+        uses: actions/setup-node@v4
        with:
-          expo-token: ${{ secrets.EXPO_TOKEN }}
+          node-version-file: .nvmrc
+          cache: yarn

-      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
+      - name: 🪛 Setup jq
+        uses: dcarbone/install-jq-action@v2
+
+      - name: 🔨 Setup EAS
+        uses: expo/expo-github-action@v8
        with:
-          xcode-version: "26.4"
+          expo-version: latest
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}

-      - name: ☕️ Assert Cocoapods version
-        run: |
-          EXPECTED=1.17.0
-          ACTUAL=$(pod --version)
-          if [ "$ACTUAL" != "$EXPECTED" ]; then
-            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
-            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
-            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
-            exit 1
-          fi
+      - name: ⛏️ Setup EAS local builds
+        run: yarn global add eas-cli-local-build-plugin
+
+      - name: ⚙️ Install dependencies
+        run: yarn install
+
+      - uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: '16.2'
+
+      - name: ☕️ Setup Cocoapods
+        uses: maxim-lobanov/setup-cocoapods@v1
+        with:
+          version: 1.14.3

      - name: 💾 Cache Pods
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@v3
        id: pods-cache
        with:
          path: ./ios/Pods
-          # We'll use the pnpm-lock.yaml for our hash since we don't yet have a Podfile.lock. Pod versions will not
-          # change unless the pnpm version changes as well.
-          key: ${{ runner.os }}-pods-${{ hashFiles('pnpm-lock.yaml') }}
+          # We'll use the yarn.lock for our hash since we don't yet have a Podfile.lock. Pod versions will not
+          # change unless the yarn version changes as well.
+          key: ${{ runner.os }}-pods-${{ hashFiles('yarn.lock') }}

      - name: 🔤 Compile translations
-        uses: ./.github/actions/compile-i18n
+        run: yarn intl:build

-      # EXPO_PUBLIC_ENV is handled in eas.json
      - name: ✏️ Write environment variables
-        id: env
-        uses: ./.github/actions/write-env
-        with:
-          env-token: ${{ secrets.ENV_TOKEN }}
-          sentry-dsn: ${{ secrets.SENTRY_DSN }}
-          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
-          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+        run: |
+          echo "${{ secrets.ENV_TOKEN }}" > .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
+          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "${{ secrets.GOOGLE_SERVICES_TOKEN }}" > google-services.json

      - name: 🏗️ EAS Build
-        uses: ./.github/actions/eas-local-build
-        with:
-          platform: ios
-          profile: ${{ inputs.profile || 'testflight' }}
-          output: build.tar.gz
-          bump-build-number: "true"
-          sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          sentry-release: ${{ steps.env.outputs.release-version }}
-          sentry-dist: ${{ steps.env.outputs.bundle-identifier }}
+        run: yarn use-build-number-with-bump eas build -p ios --profile ${{ inputs.profile || 'testflight' }} --local --output build.ipa --non-interactive

-      - name: 📂 Extract build artifact
-        run: |
-          if [ -f "build.tar.gz" ]; then
-            echo "Extracting build.tar.gz..."
-            rm -rf ios-build
-            mkdir -p ios-build
-            tar -xzf build.tar.gz -C ios-build
-            echo "Extraction completed successfully"
-
-            echo ""
-            echo "Top-level extracted files:"
-            find ios-build -maxdepth 3 -print
-
-            echo ""
-            echo "Searching for IPA..."
-            IPA_PATH="$(find ios-build -type f -name '*.ipa' -print -quit)"
-            if [ -z "$IPA_PATH" ]; then
-              echo "ERROR: No .ipa found anywhere under ios-build."
-              echo "Archive contents:"
-              tar -tzf build.tar.gz | sed -n '1,200p'
-              exit 1
-            fi
-
-            BUILD_DIR="$(dirname "$IPA_PATH")"
-            echo "Found IPA at: $IPA_PATH"
-            echo "Build dir: $BUILD_DIR"
-            echo ""
-            echo "Build dir contents:"
-            ls -la "$BUILD_DIR"
-            echo "BUILD_DIR=$BUILD_DIR" >> $GITHUB_ENV
-          else
-            echo "Archive file not found!"
-            exit 1
-          fi
+      - name: 🚀 Deploy
+        run: eas submit -p ios --non-interactive --path build.ipa

      - name: 📚 Get version from package.json
        id: get-build-info
        run: bash scripts/setGitHubOutput.sh

-      # Read the build number straight from the IPA's CFBundleVersion. This is the value
-      # baked in at build time by use-build-number-with-bump (remote counter + 1) and the
-      # number that actually lands in App Store Connect. `eas build:version:get` reads the
-      # remote counter, which a --local build does not advance, so it can be off by one —
-      # using it here would make distribute_only poll for a nonexistent build.
-      # PlistBuddy is macOS-only, which is why this stays in the build job.
-      - name: 🔢 Read build number from IPA
-        id: ipa-build-number
-        run: |
-          plist_dir="$(mktemp -d)"
-          unzip -o -q "$BUILD_DIR/Bluesky.ipa" 'Payload/*.app/Info.plist' -d "$plist_dir"
-          plist="$(find "$plist_dir" -name Info.plist -print -quit)"
-          build_number="$(/usr/libexec/PlistBuddy -c 'Print CFBundleVersion' "$plist")"
-          rm -rf "$plist_dir"
-          if [ -z "$build_number" ]; then
-            echo "ERROR: could not read CFBundleVersion from IPA"
-            exit 1
-          fi
-          echo "IPA build number: $build_number"
-          echo "build-number=$build_number" >> "$GITHUB_OUTPUT"
-
-      # Hand the IPA and dSYM off to the submit job. Retention is deliberately short since
-      # this artifact only exists to bridge the two jobs within a single run.
-      - name: 🚀 Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ios-build-${{ github.run_id }}
-          retention-days: 1
-          if-no-files-found: error
-          path: |
-            ${{ env.BUILD_DIR }}/Bluesky.ipa
-            ${{ env.BUILD_DIR }}/Bluesky.app.dSYM.zip
-
-  submit:
-    name: Submit iOS
-    # Submission and dSYM upload are I/O bound and don't need the xlarge builder.
-    runs-on: macos-26
-    needs: [build]
-    steps:
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          # eas submit reads the app config from the repo
-          fetch-depth: 5
-
-      - name: 🔧 Setup Expo project
-        uses: ./.github/actions/setup-expo-project
-        with:
-          expo-token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⬇️ Download build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ios-build-${{ github.run_id }}
-          path: ios-build
-
-      - name: 🚀 Deploy
-        run: pnpm eas submit -p ios --non-interactive --path ios-build/Bluesky.ipa
-
-      - name: 🪲 Upload dSYM to Sentry
-        env:
-          SENTRY_ORG: blueskyweb
-          SENTRY_PROJECT: app
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-        run: pnpm sentry-cli debug-files upload ios-build/Bluesky.app.dSYM.zip --include-sources
-
      - name: 🔔 Notify Slack of Production Build
        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
+        uses: slackapi/slack-github-action@v1.25.0
        with:
-          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload-templated: true
          payload: |
-            {"text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.build-number }}```"}
-
-  distribute:
-    name: Assign build to TestFlight group
-    # fastlane and jq ship preinstalled on the macOS runner image, and this step mostly idles
-    # polling Apple processing, so it runs on a normal-size runner.
-    runs-on: macos-26
-    needs: [build, submit]
-    # testFlightGroup defaults to 'none' on both workflow_call and dispatch; guard against the
-    # empty string too, since `!= 'none'` alone would be true for ''.
-    if: ${{ inputs.testFlightGroup && inputs.testFlightGroup != 'none' }}
-    steps:
-      # eas submit only uploads to App Store Connect; it can't assign a build to a
-      # TestFlight group. fastlane's distribute_only mode skips the upload and assigns the
-      # already-submitted build to the group, polling until Apple finishes processing it.
-      - name: 🧪 Assign build to TestFlight group
+            {
+              "text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}```"
+            }
        env:
-          TESTFLIGHT_GROUP: ${{ inputs.testFlightGroup }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
-          APP_VERSION: ${{ needs.build.outputs.package-version }}
-          BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
-        run: |
-          # Ensure the API key material is removed even if fastlane exits non-zero
-          # (the step runs under `bash -e`, which would otherwise abort before cleanup).
-          trap 'rm -f asc_api_key.json' EXIT
-          # fastlane's Token.from_json_file expects the .p8 contents inline under "key"
-          # (PEM with embedded newlines), not a path. jq handles the newline escaping.
-          key_content="$(echo "$ASC_KEY_P8_BASE64" | base64 --decode)"
-          jq -n \
-            --arg key_id "$ASC_KEY_ID" \
-            --arg issuer_id "$ASC_ISSUER_ID" \
-            --arg key "$key_content" \
-            '{key_id: $key_id, issuer_id: $issuer_id, key: $key, in_house: false}' \
-            > asc_api_key.json
-          # app_platform is required in non-interactive mode: distribute_only otherwise
-          # calls fetch_app_platform, which prompts for input and crashes without a TTY.
-          fastlane run upload_to_testflight \
-            api_key_path:"$PWD/asc_api_key.json" \
-            distribute_only:true \
-            app_platform:"ios" \
-            app_identifier:"xyz.blueskyweb.app" \
-            app_version:"$APP_VERSION" \
-            build_number:"$BUILD_NUMBER" \
-            groups:"$TESTFLIGHT_GROUP" \
-            notify_external_testers:true
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+
+      - name: ⬇️ Restore Cache
+        id: get-base-commit
+        uses: actions/cache@v4
+        if: ${{ inputs.profile == 'testflight' }}
+        with:
+          path: most-recent-testflight-commit.txt
+          key: most-recent-testflight-commit
+
+      - name: ✏️ Write commit hash to cache
+        if: ${{ inputs.profile == 'testflight' }}
+        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
@@ -18,37 +18,18 @@ on:
        description: Runtime version (in x.x.x format) that this update is for
        required: true

-# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
-permissions:
-  contents: read
-
-# denis release tag in bluesky-social/tango whose linux-amd64 binary this
-# workflow downloads to publish OTA bundles. Bump this one line to roll denis.
-env:
-  DENIS_RELEASE_TAG: denis-v0.1.1
-
 jobs:
  bundleDeploy:
-    if: github.repository == 'bluesky-social/social-app'
    name: Bundle and Deploy EAS Update
    runs-on: ubuntu-latest
-    # id-token: write lets this job mint an OIDC token to assume the denis
-    # publish role; actions: read loads the fingerprint baseline artifact;
-    # contents: read is still needed for the checkout.
-    permissions:
-      id-token: write
-      actions: read
-      contents: read
    concurrency:
      group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}-deploy
      cancel-in-progress: true
    outputs:
-      # A version bump forces a native build even if the fingerprint is unchanged
-      changes-detected: ${{ steps.fingerprint.outputs.includes-changes ||
-        steps.version.outputs.version-changed }}
+      changes-detected: ${{ steps.fingerprint.outputs.includes-changes }}

    steps:
-      - name: 🔑 Check for EXPO_TOKEN
+      - name: Check for EXPO_TOKEN
        run: >
          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
@@ -57,16 +38,14 @@ jobs:

      # Validate the version if one is supplied. This should generally happen if the update is for a production client
      - name: 🧐 Validate version
-        env:
-          RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
        if: ${{ inputs.runtimeVersion }}
        run: |
-          if [ -z "$RUNTIME_VERSION" ]; then
-            [[ "$RUNTIME_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "Version is valid" || exit 1
+          if [ -z "${{ inputs.runtimeVersion }}" ]; then
+            [[ "${{ inputs.runtimeVersion }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "Version is valid" || exit 1
          fi

      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

@@ -74,298 +53,271 @@ jobs:
        if: ${{ github.ref != 'refs/heads/main' }}
        run: git fetch origin main:main --depth 100

-      # A change to the version in package.json means a new native release, so
-      # an OTA update must not be deployed and full native builds are required
-      # regardless of what the fingerprint says
-      - name: 🔢 Check for version change
-        id: version
-        if: ${{ github.event_name == 'push' }}
-        env:
-          EVENT_BEFORE: ${{ github.event.before }}
-        run: |
-          CURRENT_VERSION=$(jq -r '.version' package.json)
-          if [ -n "$EVENT_BEFORE" ] && [[ ! "$EVENT_BEFORE" =~ ^0+$ ]] && git cat-file -e "$EVENT_BEFORE:package.json" 2>/dev/null; then
-            PREVIOUS_VERSION=$(git show "$EVENT_BEFORE:package.json" | jq -r '.version')
-          else
-            PREVIOUS_VERSION=$(git show HEAD~1:package.json | jq -r '.version')
-          fi
-          echo "Previous version: $PREVIOUS_VERSION, current version: $CURRENT_VERSION"
-          if [ "$CURRENT_VERSION" != "$PREVIOUS_VERSION" ]; then
-            echo "Version changed, full native builds are required"
-            echo "version-changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
      - name: 🔧 Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@v4
        with:
-          node-version-file: package.json
-          cache: pnpm
-
-      - name: ⬇️ Load fingerprint baseline
-        id: baseline
-        if: ${{ (inputs.channel || 'testflight') == 'testflight' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY_ID: ${{ github.repository_id }}
-        run: |
-          url=$(gh api \
-            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=testflight-native-fingerprint&per_page=100" \
-            --jq "[.artifacts[] | select(
-              .expired == false and
-              .workflow_run.head_branch == \"main\" and
-              .workflow_run.head_repository_id == (\$ENV.REPOSITORY_ID | tonumber)
-            )] | max_by(.created_at) | .archive_download_url" \
-            2>/dev/null || true)
-
-          if [ -n "$url" ] && [ "$url" != "null" ]; then
-            mkdir baseline-artifact
-            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o baseline.zip "$url" \
-              && unzip -q baseline.zip -d baseline-artifact; then
-              if jq -e '.sources | type == "array"' \
-                baseline-artifact/native-fingerprint.json >/dev/null; then
-                echo "path=baseline-artifact/native-fingerprint.json" >> "$GITHUB_OUTPUT"
-              else
-                echo "::warning::Ignoring invalid fingerprint baseline artifact."
-              fi
-            else
-              echo "::warning::Could not download fingerprint baseline artifact."
-            fi
-          fi
+          node-version-file: .nvmrc
+          cache: yarn

      - name: 📷 Check fingerprint and install dependencies
        id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@abc6a46eb4badf243f55bfd7d6cec42722456300 # v0.3.0
+        uses: bluesky-social/github-actions/fingerprint-native@main
        with:
          profile: ${{ inputs.channel || 'testflight' }}
          previous-commit-tag: ${{ inputs.runtimeVersion }}
-          # The recordBaseline job uploads this marker after a successful deploy;
-          # on the native path, that requires both builds to succeed. A missing
-          # marker forces native builds so they can seed the baseline safely.
-          baseline-fingerprint-path: ${{ steps.baseline.outputs.path }}

-      # Hand the full fingerprint to recordBaseline through a short-lived
-      # artifact. It is uploaded unconditionally but promoted to the persistent
-      # baseline only after both native builds succeed.
-      - name: 🚀 Upload native fingerprint
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: native-fingerprint-${{ github.run_id }}
-          path: ${{ steps.fingerprint.outputs.current-fingerprint-path }}
-          retention-days: 1
-          if-no-files-found: error
+      - name: Lint check
+        run: yarn lint

-      - name: 🔤 Compile translations
-        uses: ./.github/actions/compile-i18n
+      - name: Lint lockfile
+        run: yarn lockfile-lint

-      - name: 🧹 Lint check
-        run: pnpm lint
+      - name: Prettier check
+        run: yarn prettier --check .

-      - name: 💅 Prettier check
-        run: pnpm prettier --check .
+      - name: Check & compile i18n
+        run: yarn intl:build

-      - name: 🔎 Type check
-        run: pnpm typecheck
+      - name: Type check
+        run: yarn typecheck

      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
+        uses: expo/expo-github-action@v8
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
        with:
-          eas-version: '19.0.5'
-          packager: 'pnpm --allow-build=dtrace-provider'
+          expo-version: latest
+          eas-version: latest
          token: ${{ secrets.EXPO_TOKEN }}

-      - name: 🪛 Setup jq
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
+      - name: ⛏️ Setup Expo
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        run: yarn global add eas-cli-local-build-plugin
+
+      - name: 🪛 Setup jq
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        uses: dcarbone/install-jq-action@v2

-      # eas.json not used here, so EXPO_PUBLIC_ENV must be written explicitly
      - name: ✏️ Write environment variables
-        id: env
-        if: ${{ !steps.fingerprint.outputs.includes-changes && !steps.version.outputs.version-changed }}
-        uses: ./.github/actions/write-env
-        with:
-          env-token: ${{ secrets.ENV_TOKEN }}
-          sentry-dsn: ${{ secrets.SENTRY_DSN }}
-          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
-          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
-          expo-public-env: ${{ inputs.channel || 'testflight' }}
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        run: |
+          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
+          echo "${{ secrets.ENV_TOKEN }}" > .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
+          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "$json" > google-services.json

      - name: 🏗️ Create Bundle
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.release-version }}
-          SENTRY_DIST=${{ steps.env.outputs.bundle-identifier }}
-          pnpm export
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        run: EXPO_PUBLIC_ENV="${{ inputs.channel || 'testflight' }}" yarn export

-      # Pin ONE bundle version for both publishes below. Each script used to call
-      # `date +%s` itself, so the same bytes reached denis and ota1 under versions
-      # seconds apart (observed: 1785102575 vs 1785102614). The version is part of
-      # the asset URL path, so each origin then served a manifest referencing a
-      # path only it had -- meaning a manifest fetched from one origin and assets
-      # fetched from the other 404. Both scripts fall back to `date +%s` when this
-      # is unset, so single-publisher callers are unaffected.
-      - name: 🔢 Pin bundle version
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        run: echo "BUNDLE_VERSION=$(date +%s)" >> "$GITHUB_ENV"
-
-      # denis on EKS has been the sole origin for updates.bsky.app since
-      # 2026-07-26, so it publishes FIRST: it is the path that actually serves
-      # clients. The legacy ota1 upload runs after it, and exists only so that
-      # rolling the Bunny origin back to ota1 would find current bundles there.
-      #
-      # The ordering is load-bearing, not cosmetic. While the legacy step ran
-      # first, its failure skipped these steps and nothing reached EITHER origin
-      # -- the dual-write took down the working path with it. Both steps are
-      # still required to pass, so a stale ota1 remains a loud failure, but the
-      # publish that serves users has already landed before the legacy one can
-      # fail.
-      #
-      # Both halves are removed together when ota1 is decommissioned (Phase 5).
-      - name: ☁️ Configure AWS credentials (denis)
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
-        with:
-          role-to-assume: arn:aws:iam::007404326489:role/denis-ci-publish
-          aws-region: us-east-2
-
-      - name: ⬇️ Setup denis CLI
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        uses: ./.github/actions/setup-denis
-        with:
-          release-tag: ${{ env.DENIS_RELEASE_TAG }}
-          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
-          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
-
-      - name: 🚀 Publish OTA to denis (S3)
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        run: pnpm use-build-number bash scripts/denisPublish.sh
-        env:
-          RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
-          CHANNEL_NAME: ${{ inputs.channel || 'testflight' }}
-
-      - name: 📦 Package Bundle and 🚀 Deploy (legacy ota1)
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        run: pnpm use-build-number bash scripts/bundleUpdate.sh
+      - name: 📦 Package Bundle and 🚀 Deploy
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        run: yarn use-build-number bash scripts/bundleUpdate.sh
        env:
          DENIS_API_KEY: ${{ secrets.DENIS_API_KEY }}
          RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
          CHANNEL_NAME: ${{ inputs.channel || 'testflight' }}

+      - name: ⬇️ Restore Cache
+        id: get-base-commit
+        uses: actions/cache@v4
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        with:
+          path: most-recent-testflight-commit.txt
+          key: most-recent-testflight-commit
+
+      - name: ✏️ Write commit hash to cache
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
+
+  # GitHub actions are horrible so let's just copy paste this in
  buildIfNecessaryIOS:
    name: Build and Submit iOS
+    runs-on: macos-15
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}-build-ios
+      cancel-in-progress: true
    needs: [bundleDeploy]
    # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
    # available here
-    if: ${{ inputs.channel != 'production' &&
-      needs.bundleDeploy.outputs.changes-detected && github.repository ==
-      'bluesky-social/social-app' }}
-    uses: ./.github/workflows/build-submit-ios.yml
-    with:
-      profile: testflight
-      testFlightGroup: none
-      # OTA rebuilds don't need the xlarge builder used for releases
-      runner: macos-26
-    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
-    # so this workflow never hands the reusable workflow the entire repo secret store.
-    secrets:
-      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
-      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
-      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
-      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-      ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
-      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected }}
+    steps:
+      - name: Check for EXPO_TOKEN
+        run: >
+          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
+            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
+            exit 1
+          fi
+
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - name: 🔧 Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: 🔨 Setup EAS
+        uses: expo/expo-github-action@v8
+        with:
+          expo-version: latest
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: ⛏️ Setup EAS local builds
+        run: yarn global add eas-cli-local-build-plugin
+
+      - name: ⚙️ Install dependencies
+        run: yarn install
+
+      - uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: '16.2'
+
+      - name: ☕️ Setup Cocoapods
+        uses: maxim-lobanov/setup-cocoapods@v1
+        with:
+          version: 1.14.3
+
+      - name: 💾 Cache Pods
+        uses: actions/cache@v3
+        id: pods-cache
+        with:
+          path: ./ios/Pods
+          # We'll use the yarn.lock for our hash since we don't yet have a Podfile.lock. Pod versions will not
+          # change unless the yarn version changes as well.
+          key: ${{ runner.os }}-pods-${{ hashFiles('yarn.lock') }}
+
+      - name: 🔤 Compile translations
+        run: yarn intl:build
+
+      - name: ✏️ Write environment variables
+        run: |
+          echo "${{ secrets.ENV_TOKEN }}" > .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
+          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "${{ secrets.GOOGLE_SERVICES_TOKEN }}" > google-services.json
+
+      - name: 🏗️ EAS Build
+        run: yarn use-build-number-with-bump eas build -p ios --profile testflight --local --output build.ipa --non-interactive
+
+      - name: 🚀 Deploy
+        run: eas submit -p ios --non-interactive --path build.ipa
+
+      - name: ⬇️ Restore Cache
+        id: get-base-commit
+        uses: actions/cache@v4
+        if: ${{ inputs.channel == 'testflight' }}
+        with:
+          path: most-recent-testflight-commit.txt
+          key: most-recent-testflight-commit
+
+      - name: ✏️ Write commit hash to cache
+        if: ${{ inputs.channel == 'testflight' }}
+        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt

  buildIfNecessaryAndroid:
    name: Build and Submit Android
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}-build-android
+      cancel-in-progress: false
    needs: [bundleDeploy]
    # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
    # available here
-    if: ${{ inputs.channel != 'production' &&
-      needs.bundleDeploy.outputs.changes-detected && github.repository ==
-      'bluesky-social/social-app' }}
-    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
-    # That job is skipped here (it needs a production tag build), but GitHub statically
-    # validates the reusable-workflow permission ceiling, so the caller must grant it.
-    permissions:
-      contents: write
-    uses: ./.github/workflows/build-submit-android.yml
-    with:
-      profile: testflight-android
-      runner: ubuntu-latest
-    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
-    # so this workflow never hands the reusable workflow the entire repo secret store.
-    secrets:
-      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
-      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
-      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
-      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-      ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
-      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected }}

-  # Advance the fingerprint baseline only after BOTH native builds have shipped
-  # the new native surface. This replaces the old actions/cache baseline, which
-  # only advanced on cache eviction and so silently froze - freezing meant every
-  # fingerprint looked changed and OTA updates stopped deploying entirely.
-  #
-  # On the native-build path, this runs only after both builds succeed. A
-  # successful OTA deploy also records its fingerprint, refreshing the
-  # persistent marker's retention without changing the native baseline.
-  #
-  # The persistent artifact replaces the old actions/cache marker without
-  # requiring a PAT or mutable repository variable. Each successful deploy adds
-  # an immutable marker; the next run reads the newest non-expired one using the
-  # built-in GITHUB_TOKEN.
-  recordBaseline:
-    name: Record fingerprint baseline
-    runs-on: ubuntu-latest
-    needs: [bundleDeploy, buildIfNecessaryIOS, buildIfNecessaryAndroid]
-    if: ${{ always() &&
-      (inputs.channel || 'testflight') == 'testflight' &&
-      needs.bundleDeploy.result == 'success' &&
-      (needs.bundleDeploy.outputs.changes-detected != 'true' ||
-      (needs.buildIfNecessaryIOS.result == 'success' &&
-      needs.buildIfNecessaryAndroid.result == 'success')) &&
-      github.repository == 'bluesky-social/social-app' }}
-    permissions:
-      actions: read
    steps:
-      - name: ⬇️ Download native fingerprint
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: native-fingerprint-${{ github.run_id }}
-
-      - name: 🧐 Validate native fingerprint
+      - name: Check for EXPO_TOKEN
        run: >
-          jq -e '.sources | type == "array"' native-fingerprint.json >/dev/null ||
-          (echo "::error::native fingerprint artifact was invalid; refusing to record it as the baseline." && exit 1)
+          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
+            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
+            exit 1
+          fi

-      - name: 🚀 Record fingerprint baseline
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v4
        with:
-          name: testflight-native-fingerprint
-          path: native-fingerprint.json
-          retention-days: 90
-          if-no-files-found: error
+          fetch-depth: 5
+
+      - name: 🔧 Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+
+      - name: 🔨 Setup EAS
+        uses: expo/expo-github-action@v8
+        with:
+          expo-version: latest
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: ⛏️ Setup EAS local builds
+        run: yarn global add eas-cli-local-build-plugin
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - name: ⚙️ Install dependencies
+        run: yarn install
+
+      - name: 🔤 Compile translations
+        run: yarn intl:build
+
+      - name: ✏️ Write environment variables
+        run: |
+          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
+          echo "${{ secrets.ENV_TOKEN }}" > .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
+          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "$json" > google-services.json
+
+      - name: 🏗️ EAS Build
+        run: yarn use-build-number-with-bump eas build -p android --profile testflight-android --local --output build.apk --non-interactive
+
+      - name: ⏰ Get a timestamp
+        id: timestamp
+        uses: nanzm/get-time-action@master
+        with:
+          format: 'MM-DD-HH-mm-ss'
+
+      - name: 🚀 Upload Artifact
+        id: upload-artifact
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 30
+          compression-level: 0
+          name: build-${{ steps.timestamp.outputs.time }}.apk
+          path: build.apk
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@v1.25.0
+        with:
+          payload: |
+            {
+              "text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact.outputs.artifact-url }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+
+      - name: ⬇️ Restore Cache
+        id: get-base-commit
+        uses: actions/cache@v4
+        if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
+        with:
+          path: most-recent-testflight-commit.txt
+          key: most-recent-testflight-commit
+
+      - name: ✏️ Write commit hash to cache
+        if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
+        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
@@ -1,76 +0,0 @@
-name: claude-mention
-
-# @claude mention handler on PR conversation comments, inline review
-# comments, and review bodies. See the header comment in
-# claude-review.yml for why this is self-contained rather than calling
-# the org reusable workflows.
-#
-# Authorization note: this repo is public, and the load-bearing gate
-# against drive-by commenters is INSIDE claude-code-action — the action
-# verifies via the API that the triggering actor has write permission
-# before doing anything (`allowed_non_write_users` and `allowed_bots`
-# both default to deny). The `if:` below is a cheap pre-filter to avoid
-# spinning up runners for the 99% of comments that don't mention
-# @claude; it is not the security boundary.
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  pull_request_review:
-    types: [submitted]
-
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-  actions: read
-  id-token: write
-
-jobs:
-  mention:
-    # Skip comments/reviews that don't mention @claude, non-PR issue
-    # comments, and events from claude[bot] itself (its review prose
-    # often quotes "@claude" and must not retrigger the workflow).
-    if: >
-      (
-        (github.event_name == 'issue_comment' &&
-          github.event.issue.pull_request != null &&
-          contains(github.event.comment.body, '@claude')) ||
-        (github.event_name == 'pull_request_review_comment' &&
-          contains(github.event.comment.body, '@claude')) ||
-        (github.event_name == 'pull_request_review' &&
-          contains(github.event.review.body, '@claude'))
-      ) &&
-      github.actor != 'claude[bot]'
-
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    concurrency:
-      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
-      cancel-in-progress: false
-
-    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 1
-
-      - name: ☁️ Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
-        with:
-          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
-          aws-region: us-east-2
-
-      - name: 🤖 Claude
-        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171
-        with:
-          use_bedrock: 'true'
-          additional_permissions: |
-            actions: read
-          track_progress: true
-          claude_args: |
-            --model global.anthropic.claude-opus-4-8
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
@@ -1,68 +0,0 @@
-name: claude-review
-
-# Automatic Claude review on PR creation/update, via Bedrock (OIDC, no
-# long-lived tokens). Self-contained: this intentionally uses upstream
-# claude-code-action defaults rather than the org reusable workflows in
-# bluesky-social/.github (which a public repo cannot call, and whose
-# customizations added no value over upstream).
-#
-# Review guidance lives in .github/claude-review-prompt.md.
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-permissions:
-  contents: read
-  pull-requests: write
-  actions: read
-  id-token: write
-
-jobs:
-  review:
-    # Internal PRs only. This repo is public: fork PRs are the bulk of
-    # community traffic and MUST NOT trigger reviews (no Bedrock spend on
-    # unvetted code, and fork PRs can't mint the OIDC token anyway —
-    # belt-and-braces with this explicit guard). Branch PRs can only be
-    # created by people with write access, i.e. org members.
-    # Bot-authored PRs (dependabot, changesets) are also skipped.
-    if: >
-      github.event.pull_request.draft == false &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.type != 'Bot'
-
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    concurrency:
-      group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
-      cancel-in-progress: true
-
-    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 1
-
-      - name: ☁️ Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
-        with:
-          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
-          aws-region: us-east-2
-
-      - name: 🤖 Claude review
-        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171
-        with:
-          use_bedrock: 'true'
-          additional_permissions: |
-            actions: read
-          track_progress: true
-          claude_args: |
-            --model global.anthropic.claude-opus-4-8
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Read .github/claude-review-prompt.md in the checked-out repo
-            and review this pull request following its guidance.
@@ -7,42 +7,37 @@ on:
      - main

 concurrency:
-  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
-      - name: ⬇️ Git Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: 🔧 Set up Go tooling
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - name: Git Checkout
+        uses: actions/checkout@v3
+      - name: Set up Go tooling
+        uses: actions/setup-go@v3
        with:
-          go-version-file: bskyweb/go.mod
-          cache-dependency-path: bskyweb/go.sum
-      - name: 📄 Dummy Static Files
+          go-version: '1.23'
+      - name: Dummy Static Files
        run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
-      - name: 🔍 Check
+      - name: Check
        run: cd bskyweb/ && make check
-      - name: 🏗️ Build (binary)
+      - name: Build (binary)
        run: cd bskyweb/ && make build
-      - name: 🧪 Test
+      - name: Test
        run: cd bskyweb/ && make test
  lint:
    runs-on: ubuntu-latest
    steps:
-      - name: ⬇️ Git Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: 🔧 Set up Go tooling
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - name: Git Checkout
+        uses: actions/checkout@v3
+      - name: Set up Go tooling
+        uses: actions/setup-go@v3
        with:
-          go-version-file: bskyweb/go.mod
-          cache-dependency-path: bskyweb/go.sum
-      - name: 📄 Dummy Static Files
+          go-version: '1.23'
+      - name: Dummy Static Files
        run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
-      - name: 🧹 Lint
+      - name: Lint
        run: cd bskyweb/ &&  make lint
@@ -9,112 +9,51 @@ concurrency:
  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
  cancel-in-progress: true

-# These jobs only check out the repo and run checks, so read access to the
-# repo contents is all the GITHUB_TOKEN needs.
-permissions:
-  contents: read
-
 jobs:
  linting:
    name: Run linters
    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          [lint, prettier, 'typecheck:ios', 'typecheck:android', 'typecheck:web']
    steps:
-      - name: ⬇️ Check out Git repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: 🔍 Verify Node version pins match package.json
-        run: |
-          set -euo pipefail
-          expected=$(node -p "require('./package.json').engines.node.replace(/[^0-9.]/g, '')")
-          rc=0
-          check() {
-            if [ "$2" != "$expected" ]; then
-              echo "::error file=$1::Node version mismatch: $1 pins '$2' but package.json is '$expected'"
-              rc=1
-            fi
-          }
-          # FROM node:X.Y.Z - service runtime images
-          for f in Dockerfile.bskylink Dockerfile.bskyogcard; do
-            v=$(grep -oE 'FROM node:[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
-            check "$f" "$v"
-          done
-          # ENV NODE_VERSION=X.Y.Z - Go images that nvm-install Node for the JS build stage
-          for f in Dockerfile.embedr; do
-            v=$(grep -oE 'NODE_VERSION=[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
-            check "$f" "$v"
-          done
-          # eas.json "node": "X.Y.Z"
-          v=$(grep -oE '"node":[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' eas.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
-          check "eas.json" "$v"
-          exit $rc
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - name: 🔧 Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Check out Git repository
+        uses: actions/checkout@v3
+      - name: Install node
+        uses: actions/setup-node@v4
        with:
-          node-version-file: package.json
-          cache: pnpm
-      - name: 📦 pnpm install
-        run: pnpm install --frozen-lockfile
-      - name: 🔤 Check & compile i18n
-        run: pnpm intl:build
-      - name: 🧹 Lint checks
-        run: pnpm ${{ matrix.job }}
-  # Aggregates the matrix results into a single stable check name so branch
-  # protection can require "Run linters" regardless of how many matrix jobs run.
-  # The result is asserted in `run` (not `if`) so a malformed expression can
-  # never silently skip the check and report a false pass.
-  linting-summary:
-    name: Run linters
-    if: always()
-    needs: [linting]
-    runs-on: ubuntu-latest
-    steps:
-      - name: ✅ Require linting to have succeeded
-        env:
-          RESULT: ${{ needs.linting.result }}
-        run: |
-          echo "linting result: $RESULT"
-          test "$RESULT" = "success"
+          node-version-file: .nvmrc
+      - name: Yarn install
+        uses: Wandalen/wretry.action@master
+        with:
+          command: yarn --frozen-lockfile
+          attempt_limit: 3
+          attempt_delay: 2000
+      - name: Lint check
+        run: yarn lint
+      - name: Lint lockfile
+        run: yarn lockfile-lint
+      - name: Prettier check
+        run: yarn prettier --check .
+      - name: Check & compile i18n
+        run: yarn intl:build
+      - name: Type check
+        run: yarn typecheck
  testing:
    name: Run tests
    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
    steps:
-      - name: ⬇️ Check out Git repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - name: 🔧 Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Check out Git repository
+        uses: actions/checkout@v3
+      - name: Install node
+        uses: actions/setup-node@v4
        with:
-          node-version-file: package.json
-          cache: pnpm
-      - name: 📦 pnpm install
-        run: pnpm install --frozen-lockfile
-      - name: 🔤 Check & compile i18n
-        run: pnpm intl:build
-      - name: 🧪 Run tests
+          node-version-file: .nvmrc
+      - name: Yarn install
+        uses: Wandalen/wretry.action@master
+        with:
+          command: yarn --frozen-lockfile
+          attempt_limit: 3
+          attempt_delay: 2000
+      - name: Check & compile i18n
+        run: yarn intl:build
+      - name: Run tests
        run: |
-          NODE_ENV=test pnpm test --forceExit --shard=${{ matrix.shard }}/${{ strategy.job-total }}
-  # Aggregates the sharded test results into a single stable check name so branch
-  # protection can require "Run tests" regardless of how many shards run.
-  # The result is asserted in `run` (not `if`) so a malformed expression can
-  # never silently skip the check and report a false pass.
-  testing-summary:
-    name: Run tests
-    if: always()
-    needs: [testing]
-    runs-on: ubuntu-latest
-    steps:
-      - name: ✅ Require testing to have succeeded
-        env:
-          RESULT: ${{ needs.testing.result }}
-        run: |
-          echo "testing result: $RESULT"
-          test "$RESULT" = "success"
+          NODE_ENV=test yarn test --forceExit
@@ -1,200 +0,0 @@
---
-name: Nightly Build
-
-on:
-  schedule:
-    - cron: "10 2 * * *" # run at 2:10 AM UTC, after the nightly i18n job
-  workflow_dispatch:
-
-# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
-permissions:
-  contents: read
-
-jobs:
-  # Generate the changelog once, shared by both platforms. The range covers commits since
-  # the previous nightly, whose commit SHA is stored as a "nightly-build-commit" artifact
-  # (advanced by the record job below, only after both builds succeed).
-  prepare:
-    name: Prepare release notes
-    if: github.repository == 'bluesky-social/social-app'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: read
-    outputs:
-      notes: ${{ steps.notes.outputs.notes }}
-    steps:
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0
-
-      - name: 📝 Generate release notes
-        id: notes
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          # Find the most recent non-expired nightly-build-commit artifact and read its SHA
-          # The artifacts API returns results newest-first, so the most recent marker is on
-          # page 1 — no --paginate needed (which would run the jq aggregation per page and
-          # could emit multiple URLs). Take the first non-expired match.
-          prev=""
-          url=$(gh api \
-            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=nightly-build-commit&per_page=100" \
-            --jq 'first(.artifacts[] | select(.expired == false)) | .archive_download_url' \
-            2>/dev/null || true)
-          if [ -n "$url" ] && [ "$url" != "null" ]; then
-            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o marker.zip "$url" \
-              && unzip -o -q marker.zip; then
-              prev=$(cat nightly-build-commit.txt 2>/dev/null | tr -d '[:space:]')
-            fi
-            rm -f marker.zip nightly-build-commit.txt
-          fi
-
-          if [ -n "$prev" ] && git cat-file -e "${prev}^{commit}" 2>/dev/null; then
-            echo "Generating notes since previous nightly: $prev"
-            range="${prev}..HEAD"
-          else
-            echo "No reachable previous nightly commit; falling back to last 30 commits."
-            range="HEAD~30..HEAD"
-          fi
-          notes=$(git log --no-merges --pretty=format:'- %s' "$range" 2>/dev/null | head -n 50)
-          if [ -z "$notes" ]; then
-            notes="Nightly build — no new commits since the last nightly."
-          fi
-          # Cap the whole changelog to keep the Slack message a reasonable size.
-          # head -c caps the combined stream; cut -c would only cap each line independently.
-          notes=$(printf '%s' "$notes" | head -c 3900)
-          {
-            echo "notes<<NOTES_EOF"
-            echo "$notes"
-            echo "NOTES_EOF"
-          } >> "$GITHUB_OUTPUT"
-
-  ios:
-    name: Nightly iOS Build
-    needs: [prepare]
-    uses: ./.github/workflows/build-submit-ios.yml
-    with:
-      profile: testflight
-      testFlightGroup: "QA Team"
-    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
-    # so the nightly build never hands the reusable workflow the entire repo secret store.
-    secrets:
-      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
-      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
-      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
-      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-      ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
-      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-
-  android:
-    name: Nightly Android Build
-    needs: [prepare]
-    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
-    # That job is skipped for nightly (it needs a production tag build), but GitHub statically
-    # validates the reusable-workflow permission ceiling, so the caller must grant it here.
-    permissions:
-      contents: write
-    uses: ./.github/workflows/build-submit-android.yml
-    with:
-      profile: testflight-android
-    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
-    # so the nightly build never hands the reusable workflow the entire repo secret store.
-    secrets:
-      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
-      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
-      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
-      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-      ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
-      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
-
-  notify-ios:
-    name: Notify Slack of iOS nightly
-    needs: [prepare, ios]
-    runs-on: ubuntu-latest
-    steps:
-      - name: 📝 Build Slack payload
-        id: payload
-        env:
-          NOTES: ${{ needs.prepare.outputs.notes }}
-          VERSION: ${{ needs.ios.outputs.package-version }}
-          BUILD_NUMBER: ${{ needs.ios.outputs.build-number }}
-        run: |
-          text="*Nightly iOS build available in TestFlight (QA Team)*
-          Version ${VERSION} (${BUILD_NUMBER})
-
-          ${NOTES}"
-          payload=$(jq -n --arg text "$text" '{text: $text}')
-          {
-            echo "payload<<PAYLOAD_EOF"
-            echo "$payload"
-            echo "PAYLOAD_EOF"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: 🔔 Notify Slack
-        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
-        with:
-          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload: ${{ steps.payload.outputs.payload }}
-
-  notify-android:
-    name: Notify Slack of Android nightly
-    needs: [prepare, android]
-    runs-on: ubuntu-latest
-    steps:
-      - name: 📝 Build Slack payload
-        id: payload
-        env:
-          NOTES: ${{ needs.prepare.outputs.notes }}
-          VERSION: ${{ needs.android.outputs.package-version }}
-          VERSION_CODE: ${{ needs.android.outputs.version-code }}
-        run: |
-          text="*Nightly Android build available (Internal track)*
-          Version ${VERSION} (${VERSION_CODE})
-
-          ${NOTES}"
-          payload=$(jq -n --arg text "$text" '{text: $text}')
-          {
-            echo "payload<<PAYLOAD_EOF"
-            echo "$payload"
-            echo "PAYLOAD_EOF"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: 🔔 Notify Slack
-        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
-        with:
-          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload: ${{ steps.payload.outputs.payload }}
-
-  # Advance the nightly marker only after both builds succeed, so a failed night's commits
-  # roll into the next successful nightly's notes rather than being silently dropped.
-  record:
-    name: Record nightly commit
-    needs: [ios, android]
-    runs-on: ubuntu-latest
-    steps:
-      - name: ✏️ Write nightly commit marker
-        env:
-          GITHUB_SHA: ${{ github.sha }}
-        run: echo "$GITHUB_SHA" > nightly-build-commit.txt
-
-      - name: 🚀 Upload nightly commit marker
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: nightly-build-commit
-          path: nightly-build-commit.txt
-          retention-days: 90
@@ -1,424 +0,0 @@
---
-name: Nightly Maestro E2E
-
-on:
-  schedule:
-    - cron: "0 4 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: nightly-maestro-e2e-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  CI: "1"
-  MAESTRO_VERSION: "2.6.1"
-  MAESTRO_DRIVER_STARTUP_TIMEOUT: "180000"
-  MAESTRO_CLI_NO_ANALYTICS: "1"
-  MAESTRO_CLI_ANALYSIS_NOTIFICATION_DISABLED: "true"
-  MAESTRO_DISABLE_UPDATE_CHECK: "1"
-
-jobs:
-  ios:
-    name: iOS Maestro E2E
-    if: github.repository == 'bluesky-social/social-app'
-    runs-on: macos-26-xlarge
-    timeout-minutes: 120
-    steps:
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: 🛠️ Select Xcode 26.4
-        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
-        with:
-          xcode-version: "26.4"
-
-      - name: 🧰 Prepare E2E configuration
-        run: |
-          mkdir -p artifacts/ios
-          echo "Installing dependencies" > artifacts/ios/phase.txt
-          cp .env.example .env.development
-          cp google-services.json.example google-services.json
-
-      - name: 🔧 Set up Expo project
-        uses: ./.github/actions/setup-expo-project
-        with:
-          expo-token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ☕️ Set up Java 17
-        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
-        with:
-          distribution: temurin
-          java-version: "17"
-
-      - name: 📦 Install dev-env dependencies
-        run: pnpm --dir dev-env install --frozen-lockfile 2>&1 | tee artifacts/ios/dependencies.log
-
-      - name: 🔤 Compile translations
-        uses: ./.github/actions/compile-i18n
-
-      - name: 📥 Install Maestro 2.6.1
-        run: |
-          echo "Installing Maestro" > artifacts/ios/phase.txt
-          curl -fsSL -o "$RUNNER_TEMP/maestro.zip" \
-            "https://github.com/mobile-dev-inc/Maestro/releases/download/cli-${MAESTRO_VERSION}/maestro.zip"
-          echo "3440825f514f537c6a96bcf5de995780c2a4a7f83a43208fdc95d4f1fecfad3b  $RUNNER_TEMP/maestro.zip" \
-            | shasum -a 256 --check
-          unzip -q "$RUNNER_TEMP/maestro.zip" -d "$RUNNER_TEMP"
-          echo "$RUNNER_TEMP/maestro/bin" >> "$GITHUB_PATH"
-          "$RUNNER_TEMP/maestro/bin/maestro" --version | tee artifacts/ios/maestro-version.log
-          test "$("$RUNNER_TEMP/maestro/bin/maestro" --version)" = "$MAESTRO_VERSION"
-
-      - name: 📱 Boot one iOS simulator
-        run: |
-          echo "Booting iOS simulator" > artifacts/ios/phase.txt
-          device_name="iPhone 17"
-          runtime_name="iOS 26.5"
-
-          runtime_id=$(xcrun simctl list runtimes available --json | jq -r \
-            --arg name "$runtime_name" \
-            '[.runtimes[] | select(.name == $name and .isAvailable != false)] | first | .identifier // empty')
-          if [ -z "$runtime_id" ]; then
-            echo "The $runtime_name simulator runtime is not installed. Available iOS runtimes:" >&2
-            xcrun simctl list runtimes available --json | jq -r \
-              '.runtimes[] | select(.name | startswith("iOS")) | "- \(.name)"' >&2
-            exit 1
-          fi
-
-          device_type_id=$(xcrun simctl list devicetypes --json | jq -r \
-            --arg name "$device_name" \
-            '[.devicetypes[] | select(.name == $name)] | first | .identifier // empty')
-          if [ -z "$device_type_id" ]; then
-            echo "The $device_name simulator device type is not installed" >&2
-            exit 1
-          fi
-
-          udid=$(xcrun simctl list devices available --json | jq -r \
-            --arg runtime "$runtime_id" \
-            --arg name "$device_name" \
-            '[.devices[$runtime][]? | select(.name == $name)] | first | .udid // empty')
-          if [ -z "$udid" ]; then
-            udid=$(xcrun simctl create "$device_name" "$device_type_id" "$runtime_id")
-          fi
-
-          echo "IOS_UDID=$udid" >> "$GITHUB_ENV"
-          xcrun simctl shutdown all || true
-          xcrun simctl boot "$udid"
-          xcrun simctl bootstatus "$udid" -b
-          echo "Using $device_name on $runtime_name ($udid)"
-
-      - name: 🏷️ Mark iOS development client build phase
-        run: echo "Building the iOS development client" > artifacts/ios/phase.txt
-
-      - name: 🏗️ Build iOS development client
-        uses: ./.github/actions/eas-local-build
-        with:
-          platform: ios
-          profile: e2e
-          output: ${{ runner.temp }}/nightly-e2e-ios.tar.gz
-          log-path: artifacts/ios/build.log
-
-      - name: 📲 Install iOS development client
-        run: |
-          build_contents="$RUNNER_TEMP/nightly-e2e-ios-build"
-          mkdir -p "$build_contents"
-          tar -xzf "$RUNNER_TEMP/nightly-e2e-ios.tar.gz" -C "$build_contents"
-          app_path=$(find "$build_contents" -type d -name '*.app' -print -quit)
-          if [ -z "$app_path" ]; then
-            echo "The local EAS build did not contain an iOS simulator app" >&2
-            exit 1
-          fi
-          xcrun simctl install "$IOS_UDID" "$app_path" 2>&1 | tee -a artifacts/ios/build.log
-
-      - name: 🧪 Run iOS Maestro suite
-        run: .github/scripts/run-nightly-e2e.sh ios "$IOS_UDID"
-
-      - name: 🧹 Clean up iOS services and simulator
-        if: always()
-        run: .github/scripts/cleanup-nightly-e2e.sh ios "${IOS_UDID:-}"
-
-      - name: 🚀 Upload iOS E2E artifacts
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: nightly-e2e-ios-${{ github.run_id }}
-          path: artifacts/ios
-          if-no-files-found: warn
-          retention-days: 7
-
-  android:
-    name: Android Maestro E2E
-    if: github.repository == 'bluesky-social/social-app'
-    # Linux-x64-32core is a repository-managed runner label.
-    runs-on: Linux-x64-32core
-    timeout-minutes: 120
-    steps:
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: 🧰 Prepare E2E configuration
-        run: |
-          mkdir -p artifacts/android
-          echo "Installing dependencies" > artifacts/android/phase.txt
-          cp .env.example .env.development
-          cp google-services.json.example google-services.json
-
-      - name: 🔧 Set up Expo project
-        uses: ./.github/actions/setup-expo-project
-        with:
-          expo-token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ☕️ Set up Java 17
-        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
-        with:
-          distribution: temurin
-          java-version: "17"
-
-      - name: 📦 Install dev-env dependencies
-        run: pnpm --dir dev-env install --frozen-lockfile 2>&1 | tee artifacts/android/dependencies.log
-
-      - name: 🔤 Compile translations
-        uses: ./.github/actions/compile-i18n
-
-      - name: 📥 Install Maestro 2.6.1
-        run: |
-          echo "Installing Maestro" > artifacts/android/phase.txt
-          curl -fsSL -o "$RUNNER_TEMP/maestro.zip" \
-            "https://github.com/mobile-dev-inc/Maestro/releases/download/cli-${MAESTRO_VERSION}/maestro.zip"
-          echo "3440825f514f537c6a96bcf5de995780c2a4a7f83a43208fdc95d4f1fecfad3b  $RUNNER_TEMP/maestro.zip" \
-            | shasum -a 256 --check
-          unzip -q "$RUNNER_TEMP/maestro.zip" -d "$RUNNER_TEMP"
-          echo "$RUNNER_TEMP/maestro/bin" >> "$GITHUB_PATH"
-          "$RUNNER_TEMP/maestro/bin/maestro" --version | tee artifacts/android/maestro-version.log
-          test "$("$RUNNER_TEMP/maestro/bin/maestro" --version)" = "$MAESTRO_VERSION"
-
-      - name: 📱 Install and boot one Android emulator
-        run: |
-          echo "Booting Android emulator" > artifacts/android/phase.txt
-          android_sdk="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-/usr/local/lib/android/sdk}}"
-          sdkmanager_bin="$android_sdk/cmdline-tools/latest/bin/sdkmanager"
-          avdmanager_bin="$android_sdk/cmdline-tools/latest/bin/avdmanager"
-          # API 35 emulator images have known stability problems in headless CI
-          # (see flutter/flutter#153445); the qemu process died deterministically
-          # on the first native stack-screen push with the API 35 image.
-          system_image="system-images;android-34;google_apis;x86_64"
-
-          if [ ! -x "$sdkmanager_bin" ] || [ ! -x "$avdmanager_bin" ]; then
-            echo "Android command-line tools were not found under $android_sdk" >&2
-            find "$android_sdk/cmdline-tools" -maxdepth 3 -type f \( \
-              -name sdkmanager -o -name avdmanager \
-            \) -print >&2 || true
-            exit 1
-          fi
-
-          export ANDROID_HOME="$android_sdk"
-          export ANDROID_SDK_ROOT="$android_sdk"
-          export PATH="$android_sdk/platform-tools:$android_sdk/emulator:$PATH"
-          echo "ANDROID_HOME=$android_sdk" >> "$GITHUB_ENV"
-          echo "ANDROID_SDK_ROOT=$android_sdk" >> "$GITHUB_ENV"
-          echo "$android_sdk/platform-tools" >> "$GITHUB_PATH"
-          echo "$android_sdk/emulator" >> "$GITHUB_PATH"
-          echo "Using Android SDK at $android_sdk"
-
-          yes | "$sdkmanager_bin" --sdk_root="$android_sdk" --licenses >/dev/null || true
-          "$sdkmanager_bin" --sdk_root="$android_sdk" \
-            "platform-tools" "emulator" "$system_image"
-
-          export ANDROID_AVD_HOME="$RUNNER_TEMP/.android/avd"
-          mkdir -p "$ANDROID_AVD_HOME"
-          echo "ANDROID_AVD_HOME=$ANDROID_AVD_HOME" >> "$GITHUB_ENV"
-          echo no | "$avdmanager_bin" create avd \
-            --force \
-            --name nightly-e2e \
-            --package "$system_image" \
-            --device pixel_6
-
-          # Reduce resolution to lighten the SwiftShader software-rendering
-          # workload, and raise RAM/cores/heap so the debug RN app has headroom.
-          # The default 2560MB RAM led to silent qemu crashes mid-flow.
-          printf 'hw.lcd.width=720\nhw.lcd.height=1600\nhw.lcd.density=280\nhw.ramSize=6144\nhw.cpu.ncore=4\nvm.heapSize=512\n' \
-            >> "$ANDROID_AVD_HOME/nightly-e2e.avd/config.ini"
-
-          if [ -e /dev/kvm ] && [ ! -w /dev/kvm ]; then
-            sudo chmod 666 /dev/kvm
-          fi
-
-          # Disable the emulator's Vulkan feature so graphics goes through the
-          # plain GLES SwiftShader translator. gfxstream Vulkan via SwiftShader
-          # Subzero crashed qemu silently at a deterministic rendering step;
-          # GLES-only is sufficient since the guest renders with skiagl.
-          #
-          # Run the launch in a background subshell so the emulator's exit
-          # status is recorded when it dies (it is otherwise backgrounded and
-          # its death is invisible). Write the emulator's real PID - not the
-          # subshell's - to emulator.pid, since cleanup-nightly-e2e.sh kills the
-          # PID from that file directly; killing the subshell would not kill the
-          # emulator child.
-          (
-            # wait returns the emulator's non-zero status on crash; set -e would
-            # abort the subshell before the status is logged.
-            set +e
-            "$android_sdk/emulator/emulator" @nightly-e2e \
-              -port 5554 \
-              -no-window \
-              -gpu swiftshader_indirect \
-              -feature -Vulkan \
-              -no-snapshot \
-              -noaudio \
-              -no-boot-anim \
-              -camera-back none \
-              > artifacts/android/emulator.log 2>&1 &
-            emulator_pid=$!
-            echo "$emulator_pid" > artifacts/android/emulator.pid
-            wait "$emulator_pid"
-            echo "Emulator exited with status $?" >> artifacts/android/emulator.log
-          ) &
-
-          adb -s emulator-5554 wait-for-device
-          booted=false
-          for _ in $(seq 1 120); do
-            if [ "$(adb -s emulator-5554 shell getprop sys.boot_completed 2>/dev/null | tr -d '\r')" = "1" ]; then
-              booted=true
-              break
-            fi
-            sleep 5
-          done
-          if [ "$booted" != "true" ]; then
-            echo "Android emulator did not finish booting" >&2
-            exit 1
-          fi
-
-          adb -s emulator-5554 shell settings put global window_animation_scale 0
-          adb -s emulator-5554 shell settings put global transition_animation_scale 0
-          adb -s emulator-5554 shell settings put global animator_duration_scale 0
-
-      - name: 🏷️ Mark Android development client build phase
-        run: echo "Building the Android development client" > artifacts/android/phase.txt
-
-      - name: 🏗️ Build Android development client
-        uses: ./.github/actions/eas-local-build
-        with:
-          platform: android
-          profile: e2e
-          output: ${{ runner.temp }}/nightly-e2e-android.apk
-          log-path: artifacts/android/build.log
-
-      - name: 📲 Install Android development client
-        run: |
-          adb -s emulator-5554 install -r "$RUNNER_TEMP/nightly-e2e-android.apk" \
-            2>&1 | tee -a artifacts/android/build.log
-
-      - name: 🧪 Run Android Maestro suite
-        run: .github/scripts/run-nightly-e2e.sh android emulator-5554
-
-      - name: 🩺 Capture emulator crash diagnostics
-        if: always()
-        run: |
-          {
-            echo "=== Emulator process status ==="
-            pgrep -fa "emulator.*nightly-e2e" || echo "Emulator process not found"
-            echo "=== Emulator exit status ==="
-            grep "Emulator exited" artifacts/android/emulator.log || echo "No emulator exit status recorded"
-            echo "=== OOM killer check (kernel) ==="
-            oom_lines=$(sudo dmesg 2>/dev/null | grep -iE "oom|killed process|out of memory" | tail -20)
-            echo "${oom_lines:-No kernel OOM evidence found (or dmesg unavailable)}"
-            echo "=== systemd-oomd check ==="
-            oomd_lines=$(journalctl -u systemd-oomd --no-pager 2>/dev/null | tail -20)
-            echo "${oomd_lines:-No systemd-oomd journal entries (or journalctl unavailable)}"
-            echo "=== journal kernel tail ==="
-            journalctl -k --no-pager 2>/dev/null | tail -30 || echo "journalctl -k unavailable"
-            echo "=== Emulator crash database ==="
-            ls -la /tmp/android-runner/emu-crash-*.db 2>/dev/null || echo "No crash database found"
-          } > artifacts/android/emulator-diagnostics.log 2>&1
-
-      - name: 🧹 Clean up Android services and emulator
-        if: always()
-        run: .github/scripts/cleanup-nightly-e2e.sh android emulator-5554
-
-      - name: 🚀 Upload Android E2E artifacts
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: nightly-e2e-android-${{ github.run_id }}
-          path: artifacts/android
-          if-no-files-found: warn
-          retention-days: 7
-
-  report:
-    name: Report E2E failures
-    needs: [ios, android]
-    if: ${{ always() && github.repository == 'bluesky-social/social-app' }}
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-    steps:
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: ⬇️ Download iOS artifacts
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: nightly-e2e-ios-${{ github.run_id }}
-          path: downloaded-artifacts/ios
-
-      - name: ⬇️ Download Android artifacts
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: nightly-e2e-android-${{ github.run_id }}
-          path: downloaded-artifacts/android
-
-      - name: 🔗 Resolve artifact links
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}#artifacts"
-          jq -n --arg run "$run_url" '{ios: $run, android: $run}' > artifact-links.json
-          if gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/artifacts?per_page=100" \
-            > artifact-response.json; then
-            jq --arg base "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/artifacts" \
-              --arg run "$run_url" \
-              '{
-                ios: (.artifacts | map(select(.name | startswith("nightly-e2e-ios-"))) | first | if . then ($base + "/" + (.id | tostring)) else $run end),
-                android: (.artifacts | map(select(.name | startswith("nightly-e2e-android-"))) | first | if . then ($base + "/" + (.id | tostring)) else $run end)
-              }' artifact-response.json > artifact-links.json
-          fi
-
-      - name: 📊 Summarize platform results
-        id: summary
-        env:
-          IOS_STATUS: ${{ needs.ios.result }}
-          ANDROID_STATUS: ${{ needs.android.result }}
-        run: |
-          node .github/scripts/summarize-maestro.mjs \
-            --ios-status "$IOS_STATUS" \
-            --android-status "$ANDROID_STATUS" \
-            --ios-root downloaded-artifacts/ios \
-            --android-root downloaded-artifacts/android \
-            --artifact-urls artifact-links.json \
-            --sha "$GITHUB_SHA" \
-            --run-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-            --commit-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}" \
-            > e2e-summary.json
-          echo "notify=$(jq -r .notify e2e-summary.json)" >> "$GITHUB_OUTPUT"
-          echo "payload=$(jq -c .payload e2e-summary.json)" >> "$GITHUB_OUTPUT"
-          jq -r .githubSummary e2e-summary.json >> "$GITHUB_STEP_SUMMARY"
-
-      - name: 🔔 Notify Slack of E2E failures
-        if: steps.summary.outputs.notify == 'true'
-        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
-        with:
-          webhook: ${{ secrets.E2E_FAILURES_SLACK_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload: ${{ steps.summary.outputs.payload }}
@@ -1,7 +1,7 @@
 name: Nightly Update Source Languages
 on:
  schedule:
-    - cron: "0 2 * * *" # run at 2 AM UTC
+    - cron: '0 2 * * *' # run at 2 AM UTC
  workflow_dispatch:

 jobs:
@@ -15,27 +15,29 @@ jobs:
      contents: write

    steps:
-      - name: ⬇️ Check out Git repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Check out Git repository
+        uses: actions/checkout@v3
        with:
          ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}}
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - name: 🔧 Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Install node
+        uses: actions/setup-node@v4
        with:
-          node-version-file: package.json
-          cache: pnpm
-      - name: 📦 pnpm install
-        run: pnpm install --frozen-lockfile
-      - name: 🔤 Extract language strings
-        run: pnpm intl:extract
-      - name: 📝 Create commit
-        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
+          node-version-file: .nvmrc
+      - name: Yarn install
+        uses: Wandalen/wretry.action@master
+        with:
+          command: yarn --frozen-lockfile
+          attempt_limit: 3
+          attempt_delay: 2000
+      - name: Extract language strings
+        run: yarn intl:extract
+      - name: Create commit
+        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Nightly source-language update
          file_pattern: ./src/locale/locales/en/messages.po
-      - name: 🚀 Push source lang to Crowdin
-        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
+      - name: Push source lang to Crowdin
+        uses: crowdin/github-action@v2
        with:
          upload_sources: true
          upload_sources_args: "-b main"
@@ -44,4 +46,4 @@ jobs:
          push_sources: false
          create_pull_request: false
        env:
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
@@ -13,139 +13,79 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

-# Permissions are granted per-job below; anything unlisted defaults to none.
-# pull-requests: write is needed by sticky-pull-request-comment to post the
-# bundle-size and fingerprint diffs and the PR OTA install link
-permissions: {}
-
-# denis release tag in bluesky-social/tango whose linux-amd64 binary the PR OTA
-# job downloads. Bump this one line to roll denis.
-env:
-  DENIS_RELEASE_TAG: denis-v0.1.1
+permissions:
+  pull-requests: write
+  actions: write
+  contents: read

 jobs:
-  # Populate this from main so every PR can restore the same trusted baseline.
-  webpack-analyzer-base:
-    runs-on: ubuntu-24.04
-    if: ${{ github.event_name == 'push' }}
-    permissions:
-      contents: read
-    steps:
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - name: 🔧 Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: package.json
-          cache: pnpm
-
-      - name: ⬇️ Get base stats from cache
-        id: get-base-stats
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: stats.json
-          key: stats-base-main-${{ github.sha }}
-
-      - name: 🔦 Generate stats file for base commit
-        if: ${{ !steps.get-base-stats.outputs.cache-hit }}
-        run: |
-          pnpm install
-          pnpm intl:build
-          pnpm generate-webpack-stats-file
-
-      - name: ⬆️ Save base stats to cache
-        if: ${{ !steps.get-base-stats.outputs.cache-hit }}
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: stats.json
-          key: stats-base-main-${{ github.sha }}
-
  webpack-analyzer:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
-    permissions:
-      contents: read
-      pull-requests: write
    steps:
      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
      - name: 🔧 Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@v4
        with:
-          node-version-file: package.json
-          cache: pnpm
+          node-version-file: .nvmrc
+          cache: yarn

-      - name: 🌿 Ensure tracking relevant branches and checkout base
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-          BASE_REF: ${{ github.base_ref }}
+      - name: Ensure tracking relevant branches and checkout base
        run: |
-          git checkout $HEAD_REF
-          git checkout $BASE_REF
+          git checkout ${{ github.head_ref }}
+          git checkout ${{ github.base_ref }}

-      - name: 🔍 Get the base commit
+      - name: Get the base commit
        id: base-commit
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: echo base-commit=$(git log -n 1 $BASE_REF --pretty=format:'%H') >> "$GITHUB_OUTPUT"
+        run: echo base-commit=$(git log -n 1 ${{ github.base_ref }} --pretty=format:'%H') >> "$GITHUB_OUTPUT"

-      - name: 🔀 Merge PR commit
-        env:
-          HEAD_REF: ${{ github.head_ref }}
+      - name: Merge PR commit
        run: |
          # Have to set a git config for the merge to work
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"
-          git merge --no-edit $HEAD_REF
-          pnpm install
-          pnpm intl:build
+          git merge --no-edit ${{ github.head_ref }}
+          yarn install

      - name: 🔦 Generate stats file for PR
        run: |
-          pnpm generate-webpack-stats-file
+          yarn generate-webpack-stats-file
          mv stats.json ../stats-new.json

      - name: ⬇️ Get base stats from cache
        id: get-base-stats
-        # Restore-only prevents PR-scoped fallback builds from creating caches.
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@v4
        with:
-          path: stats.json
-          key: stats-base-main-${{ steps.base-commit.outputs.base-commit }}
+          path: stats-base.json
+          key: stats-base-${{ steps.base-commit.outputs.base-commit }}

-      - name: ⏪ Restore to base commit
+      - name: Restore to base commit
        if: ${{ !steps.get-base-stats.outputs.cache-hit }}
-        env:
-          BASE_COMMIT: ${{ steps.base-commit.outputs.base-commit }}
        run: |
-          git reset "$BASE_COMMIT"
+          git reset HEAD~
          git restore .

      - name: 🔦 Generate stats file from base commit
        if: ${{ !steps.get-base-stats.outputs.cache-hit }}
        run: |
-          pnpm install
-          pnpm intl:build
-          pnpm generate-webpack-stats-file
+          yarn install
+          yarn generate-webpack-stats-file
+          mv stats.json stats-base.json

      - name: ％ Get diff
        id: get-diff
-        uses: NejcZdovc/bundle-size-diff@5321de41d2d62a7b0f4d6e60f59d1280a0034160 # v1.1.0
+        uses: NejcZdovc/bundle-size-diff@v1
        with:
-          base_path: "stats.json"
-          pr_path: "../stats-new.json"
-          excluded_assets: "(.+).chunk.js|(.+).js.map|(.+).json|(.+).png|(.+).svg|(.+).webp|(.+).jpg|(.+).ico"
+          base_path: 'stats-base.json'
+          pr_path: '../stats-new.json'
+          excluded_assets: '(.+).chunk.js|(.+).js.map|(.+).json|(.+).png'

      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: bundle-diff
          message: |
@@ -157,16 +97,9 @@ jobs:
  fingerprint-native:
    runs-on: ubuntu-22.04
    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
-    permissions:
-      contents: read
-      pull-requests: write
-    outputs:
-      # Empty when the native surface is unchanged, 'true' when it changed.
-      # publish-pr-ota gates on this.
-      includes-changes: ${{ steps.fingerprint.outputs.includes-changes }}
    steps:
      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v4
        with:
          fetch-depth: 100

@@ -174,23 +107,20 @@ jobs:
        run: git fetch origin main:main --depth 100
        if: github.event_name == 'pull_request'

-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
      - name: 🔧 Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@v4
        with:
-          node-version-file: package.json
-          cache: pnpm
+          node-version-file: .nvmrc
+          cache: yarn

      - name: 📷 Check fingerprint and install dependencies
        id: fingerprint
-        timeout-minutes: 5
-        uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.2.0
+        uses: bluesky-social/github-actions/fingerprint-native@main
        with:
          profile: pull-request

      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        uses: marocchino/sticky-pull-request-comment@v2
        if: ${{ steps.fingerprint.outputs.includes-changes }}
        with:
          header: fingerprint-diff
@@ -208,160 +138,9 @@ jobs:
            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*

      - name: 💬 Delete comment
-        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        uses: marocchino/sticky-pull-request-comment@v2
        if: ${{ !steps.fingerprint.outputs.includes-changes }}
        with:
          header: fingerprint-diff
          delete: true

-      # publish-pr-ota is skipped once the fingerprint changes, so any install
-      # link left over from an earlier fingerprint-clean commit on this PR now
-      # points at a bundle that no longer matches the PR. Drop it.
-      - name: 💬 Delete stale OTA install comment
-        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
-        if: ${{ steps.fingerprint.outputs.includes-changes }}
-        with:
-          header: pull-request-ota
-          delete: true
-
-      - name: 🏷️ Label as fingerprint changed
-        if: ${{ steps.fingerprint.outputs.includes-changes }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh pr edit "$PR_NUMBER" --add-label "bot: fingerprint changed" || true
-
-      - name: 🏷️ Remove fingerprint changed label
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh pr edit "$PR_NUMBER" --remove-label "bot: fingerprint changed" || true
-
-  # Automatic per-PR OTA preview, published to the pull-request-<N> channel on
-  # denis. Replaces the old `@github-actions ota` comment trigger. Gated to
-  # same-repo PRs (fork guard): a branch can only exist in this repo if someone
-  # with write access pushed it, so an outside contributor (who can only open a
-  # PR from a fork) never runs this job with the denis publish role in scope.
-  # This matches the fork-guard gate the other jobs in this workflow use;
-  # author_association is deliberately NOT checked (it can't identify a private
-  # org member and would skip their PRs).
-  #
-  # Bot authors are excluded: Dependabot pushes in-repo branches, so it passes
-  # the fork guard, but GitHub withholds repo secrets from Dependabot-triggered
-  # runs. EXPO_TOKEN is then empty and the job fails at setup — a red check on
-  # every dependabot PR. There is no OTA preview worth publishing for a
-  # dependency bump anyway.
-  #
-  # Gated on a clean fingerprint-native run: an OTA can only carry JS, so once
-  # the native surface changes the published bundle no longer represents the PR
-  # and installing it on a store/TestFlight client is misleading at best. Those
-  # PRs need a native build instead. A skipped or failed fingerprint job also
-  # skips this one - without a verdict we can't say the OTA is representative.
-  publish-pr-ota:
-    name: Publish PR OTA to denis
-    needs: fingerprint-native
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.type != 'Bot' &&
-      needs.fingerprint-native.outputs.includes-changes != 'true'
-    concurrency:
-      group: pr-ota-${{ github.event.pull_request.number }}
-      cancel-in-progress: true
-    permissions:
-      id-token: write
-      contents: read
-    steps:
-      - name: ⬇️ Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: 🛠️ Setup Expo project
-        uses: ./.github/actions/setup-expo-project
-        with:
-          expo-token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: 🔤 Compile translations
-        uses: ./.github/actions/compile-i18n
-
-      - name: ✏️ Write environment variables
-        id: env
-        uses: ./.github/actions/write-env
-        with:
-          env-token: ${{ secrets.ENV_TOKEN }}
-          sentry-dsn: ${{ secrets.SENTRY_DSN }}
-          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
-          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
-          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
-          expo-public-env: testflight
-
-      - name: 🏗️ Create Bundle
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.release-version }}
-          SENTRY_DIST=${{ steps.env.outputs.bundle-identifier }}
-          pnpm export
-
-      - name: ☁️ Configure AWS credentials (denis, PR-scoped)
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
-        with:
-          role-to-assume: arn:aws:iam::007404326489:role/denis-ci-publish-pr
-          aws-region: us-east-2
-          # Defense-in-depth: the base role is already scoped to pr/*, but narrow
-          # this session further to just THIS PR's prefix so a bug can't write to
-          # another PR's objects or the prod tree.
-          inline-session-policy: |-
-            {
-              "Version": "2012-10-17",
-              "Statement": [
-                {
-                  "Effect": "Allow",
-                  "Action": ["s3:PutObject", "s3:DeleteObject"],
-                  "Resource": "arn:aws:s3:::bsky-denis-ota-prod/pr/${{ github.event.pull_request.number }}/*"
-                },
-                {
-                  "Effect": "Allow",
-                  "Action": "s3:ListBucket",
-                  "Resource": "arn:aws:s3:::bsky-denis-ota-prod",
-                  "Condition": {
-                    "StringLike": { "s3:prefix": "pr/${{ github.event.pull_request.number }}/*" }
-                  }
-                }
-              ]
-            }
-
-      - name: ⬇️ Setup denis CLI
-        uses: ./.github/actions/setup-denis
-        with:
-          release-tag: ${{ env.DENIS_RELEASE_TAG }}
-          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
-          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
-
-      - name: 🚀 Publish OTA to denis (S3)
-        run: pnpm use-build-number bash scripts/denisPublish.sh
-        env:
-          RUNTIME_VERSION: ''
-          CHANNEL_NAME: pull-request-${{ github.event.pull_request.number }}
-
-  comment-pr-ota:
-    name: Comment PR OTA install link
-    needs: publish-pr-ota
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    steps:
-      - name: 💬 Drop OTA install comment
-        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
-        with:
-          header: pull-request-ota
-          message: |
-            The OTA deployment for this PR was successful! You may now apply it by either scanning the QR code or opening the deep link below in your browser:
-
-            <img src="https://bsky-qr.vercel.app?channel=pull-request-${{ github.event.pull_request.number }}" width="300" height="300" alt="QR code for the PR OTA deployment">
-
-            `bluesky://intent/apply-ota?channel=pull-request-${{ github.event.pull_request.number }}`
@@ -1,43 +0,0 @@
-name: Sync to internal repo
-
-on:
-  push:
-    branches: [main]
-
-# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
-permissions:
-  contents: read
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    if: github.repository == 'bluesky-social/social-app'
-    steps:
-      - name: ⬇️ Checkout public repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0
-          # Don't persist the checkout auth header; the push below authenticates
-          # with the app token embedded in the remote URL instead
-          persist-credentials: false
-      - name: 🔑 Generate GitHub App Token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
-          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
-          repositories: social-app-internal
-          # Scope the token down from the app's full installation permissions;
-          # pushing is the only thing this token is used for. The workflows
-          # permission is required because the sync includes files under
-          # .github/workflows/, which GitHub refuses to push without it.
-          permission-contents: write
-          permission-workflows: write
-      - name: 🚀 Push to internal repo
-        env:
-          TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          git config user.name "github-actions"
-          git config user.email "test@users.noreply.github.com"
-          git remote add internal https://x-access-token:${TOKEN}@github.com/bluesky-social/social-app-internal.git
-          git push internal main --force
@@ -1,51 +0,0 @@
-name: Lockfile
-
-on:
-  pull_request:
-concurrency:
-  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  verify-pnpm-lock:
-    name: No manual pnpm-lock.yaml edits
-    runs-on: ubuntu-latest
-    steps:
-      - name: ⬇️ Check out PR HEAD
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0
-
-      - name: ⬇️ Fetch base branch
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: git fetch origin $BASE_REF --depth=1
-
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - name: 🔧 Install node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: package.json
-
-      - name: ⏪ Reset pnpm-lock.yaml to base
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: git show "origin/$BASE_REF:pnpm-lock.yaml" > pnpm-lock.yaml
-
-      - name: 📦 pnpm install
-        # Fine to skip scripts since we don't run any code
-        run: pnpm clean && pnpm install --ignore-scripts --no-frozen-lockfile
-
-      - name: 🔍 Verify pnpm-lock.yaml
-        run: |
-          git diff --quiet --exit-code || {
-            echo '::error::`pnpm-lock.yaml` does not match what pnpm would generate given the base `pnpm-lock.yaml` and the head `package.json`.'
-            echo '::error:: - If this is intentional, you can ignore this check.'
-            echo '::error:: - If this is unintentional, apply the following diff:'
-            git --no-pager diff
-            exit 1
-          }
@@ -0,0 +1,46 @@
+name: Lockfile
+
+on:
+  pull_request:
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  verify-yarn-lock:
+    name: No manual yarn.lock edits
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out PR HEAD
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Fetch base branch
+        run: git fetch origin ${{ github.base_ref }} --depth=1
+
+      - name: Install node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+
+      - name: Reset yarn.lock to base
+        run: git show "origin/${{ github.base_ref }}:yarn.lock" > yarn.lock
+
+      - name: Yarn install
+        uses: Wandalen/wretry.action@master
+        with:
+          # Fine to skip scripts since we don't run any code
+          command: yarn install --ignore-scripts
+          attempt_limit: 3
+          attempt_delay: 2000
+
+      - name: Verify yarn.lock
+        run: |
+          git diff --quiet --exit-code || {
+            echo '::error::`yarn.lock` does not match what Yarn would generate given the base `yarn.lock` and the head `package.json`.'
+            echo '::error:: - If this is intentional, you can ignore this check.'
+            echo '::error:: - If this is unintentional, apply the following diff:'
+            git --no-pager diff
+            exit 1
+          }
@@ -1,37 +0,0 @@
-name: Workflow security
-
-on:
-  push:
-    branches: [main]
-    paths: [".github/**"]
-  pull_request:
-    paths: [".github/**"]
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
-  cancel-in-progress: true
-
-# The github.token is only used by zizmor's online audits (read-only API calls)
-permissions:
-  contents: read
-
-jobs:
-  zizmor:
-    name: Audit workflows with zizmor
-    runs-on: ubuntu-latest
-    steps:
-      - name: ⬇️ Check out Git repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: 🛡️ Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
-        with:
-          # Annotate the PR directly instead of uploading SARIF to the
-          # security tab, and fail the check on any finding
-          advanced-security: false
-          annotations: true
-          # Low-confidence findings (e.g. artipacked on workflows that never
-          # push) are too noisy to gate CI on
-          min-confidence: medium
@@ -58,7 +58,6 @@ buck-out/
 # Ruby / CocoaPods
 /ios/Pods/
 /vendor/bundle/
-Gemfile.lock

 # Testing
 coverage/
@@ -86,9 +85,6 @@ stats.json
 # VSCode
 .vscode

-# Zed
-.zed
-
 # gitignore and github actions
 !.gitignore
 !.github
@@ -108,14 +104,12 @@ google-services.json
 # Performance results (Flashlight)
 .perf/

-# Oxlint
-.oxlintcache
+# ESLint
+.eslintcache

 # i18n
 src/locale/locales/_build/
-src/locale/locales/**/messages.js
-src/locale/locales/**/messages.mjs
-src/locale/locales/**/messages.ts
+src/locale/locales/**/*.js

 # local builds
 *.apk
@@ -124,16 +118,3 @@ src/locale/locales/**/messages.ts

 # ogcard assets
 bskyogcard/src/assets/fonts/noto-*
-
-# bskyweb build output
-bskyweb/static/media/*.webp
-bskyweb/static/media/*.jpg
-bskyweb/static/media/*.png
-bskyweb/static/media/*.svg
-
-# superpowers plugin plans/specs — local-only workspace
-docs/superpowers/
-.claude/worktrees
-
-# pnpm
-.pnpm-store/
@@ -1 +1,4 @@
-pnpm exec lint-staged --concurrent false
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+npx lint-staged
@@ -1,236 +0,0 @@
-/**
- * Codemod to update Lingui's useLingui() hook to use v5.
- *
- * Before:
- *   import {msg} from '@lingui/core/macro'
- *   import {useLingui} from '@lingui/react'
- *   const {_} = useLingui()
- *   _(msg`Lorem ipsum`)
- *
- * After:
- *   import {useLingui} from '@lingui/react/macro'
- *   const {t: l} = useLingui()
- *   l`Lorem ipsum`
- *
- * Usage: jscodeshift -t .jscodeshift/file/lingui-v5.js <file-path>
- * Example: jscodeshift -t .jscodeshift/file/lingui-v5.js modules/bottom-sheet/src/lib/Portal.tsx
- */
-
-/* eslint-disable */
-
-export const parser = 'tsx'
-
-export default function transformer(file, api) {
-  const j = api.jscodeshift
-
-  const root = j(file.source)
-
-  // Remove msg imports, including aliased imports
-  root
-    .find(j.ImportDeclaration)
-    .filter(path => path.node.source.value === '@lingui/core/macro')
-    .forEach(path => {
-      const newSpecifiers = path.node.specifiers.filter(specifier => {
-        if (j.ImportSpecifier.check(specifier)) {
-          const importedName = specifier.imported
-            ? specifier.imported.name
-            : specifier.local.name
-          const localName = specifier.local
-            ? specifier.local.name
-            : importedName
-
-          return !(
-            importedName === 'msg' &&
-            (localName === 'msg' || localName === 'msgLingui')
-          )
-        }
-        return true
-      })
-
-      if (newSpecifiers.length > 0) {
-        path.node.specifiers = newSpecifiers
-      } else {
-        j(path).remove()
-      }
-    })
-
-  // Update React imports
-  root
-    .find(j.ImportDeclaration)
-    .filter(path => path.node.source.value === '@lingui/react')
-    .forEach(path => {
-      path.node.source = j.stringLiteral('@lingui/react/macro')
-    })
-
-  // Replace {_} with {t: l}
-  root
-    .find(j.VariableDeclarator, {
-      init: {
-        type: 'CallExpression',
-        callee: {name: 'useLingui'},
-      },
-    })
-    .replaceWith(nodePath => {
-      const {node} = nodePath
-      for (let i = 0; i < node.id.properties.length; i++) {
-        if (node.id.properties[i].key.name === '_') {
-          node.id.properties[i].key = j.identifier('t')
-          node.id.properties[i].shorthand = false
-          node.id.properties[i].value = j.identifier('l')
-        }
-      }
-      return node
-    })
-
-  // Replace {_: _l} with {t: l}
-  root
-    .find(j.VariableDeclarator, {
-      init: {callee: {name: 'useLingui'}},
-      id: {
-        properties: properties =>
-          properties.some(p => p.key.name === '_' && p.value.name === '_l'),
-      },
-    })
-    .forEach(path => {
-      const prop = path.node.id.properties.find(
-        p => p.key.name === '_' && p.value.name === '_l',
-      )
-      if (prop) {
-        prop.key.name = 't'
-        prop.value.name = 'l'
-      }
-    })
-
-  // Replace _(msg``) with l``
-  root
-    .find(j.CallExpression, {
-      callee: {name: '_'},
-      arguments: [
-        {
-          type: 'TaggedTemplateExpression',
-          tag: {name: 'msg'},
-        },
-      ],
-    })
-    .replaceWith(path => {
-      const quasis = path.node.arguments[0].quasi
-
-      return j.taggedTemplateExpression(j.identifier('l'), quasis)
-    })
-
-  // Replace _l(msgLingui``) with l``
-  root
-    .find(j.CallExpression, {
-      callee: {name: '_l'},
-      arguments: [
-        {
-          type: 'TaggedTemplateExpression',
-          tag: {name: 'msgLingui'},
-        },
-      ],
-    })
-    .replaceWith(path => {
-      const quasis = path.node.arguments[0].quasi
-
-      return j.taggedTemplateExpression(j.identifier('l'), quasis)
-    })
-
-  // Replace _(msg()) with l()
-  root
-    .find(j.CallExpression, {
-      callee: {name: '_'},
-      arguments: [
-        {
-          type: 'CallExpression',
-          callee: {name: 'msg'},
-        },
-      ],
-    })
-    .replaceWith(path => {
-      return j.callExpression(j.identifier('l'), [
-        path.node.arguments[0].arguments[0],
-      ])
-    })
-
-  // Replace _l(msgLingui()) with l()
-  root
-    .find(j.CallExpression, {
-      callee: {name: '_l'},
-      arguments: [
-        {
-          type: 'CallExpression',
-          callee: {name: 'msgLingui'},
-        },
-      ],
-    })
-    .replaceWith(path => {
-      return j.callExpression(j.identifier('l'), [
-        path.node.arguments[0].arguments[0],
-      ])
-    })
-
-  // Replace _(plural()) with plural()
-  root
-    .find(j.CallExpression, {
-      callee: {
-        type: 'Identifier',
-        name: '_',
-      },
-    })
-    .forEach(path => {
-      const callExpression = path.node
-      if (
-        callExpression.arguments.length === 1 &&
-        callExpression.arguments[0].type === 'CallExpression'
-      ) {
-        const innerCall = callExpression.arguments[0]
-
-        if (
-          innerCall.callee.type === 'Identifier' &&
-          innerCall.callee.name === 'plural'
-        ) {
-          j(path).replaceWith(innerCall)
-        }
-      }
-    })
-
-  // Update hook dependency arrays
-  root
-    .find(j.CallExpression, {
-      callee: callee => {
-        if (
-          callee.type === 'Identifier' ||
-          callee.type === 'MemberExpression'
-        ) {
-          return true
-        }
-        if (
-          ['useCallback', 'useEffect', 'useMemo'].includes(callee.name) &&
-          callee.type === 'MemberExpression' &&
-          callee.object.type === 'Identifier' &&
-          callee.object.name === 'React' &&
-          callee.property.type === 'Identifier' &&
-          callee.property.name === 'useCallback'
-        ) {
-          return true
-        }
-        return false
-      },
-    })
-    .forEach(path => {
-      const dependencyArray = path.node.arguments[1]
-      if (dependencyArray && dependencyArray.type === 'ArrayExpression') {
-        dependencyArray.elements = dependencyArray.elements.map(element => {
-          if (
-            element.type === 'Identifier' &&
-            (element.name === '_' || element.name === '_l')
-          ) {
-            return j.identifier('l')
-          }
-          return element
-        })
-      }
-    })
-
-  return root.toSource()
-}
@@ -1,62 +0,0 @@
-/**
- * Codemod to replace BskyAgent with AtpAgent
- *
- * Before:
- *   import {BskyAgent} from '@atproto/api`
- *   BskyAgent.appLabelers.includes(labeler)
- *
- * After:
- *   import {AtpAgent} from '@atproto/api`
- *   AtpAgent.appLabelers.includes(labeler)
- *
- * Handles import specifiers, type annotations, static member access
- * (BskyAgent.configure), `extends BskyAgent`, and `new BskyAgent()`. Whole
- * identifiers only, so names like `OpaqueBskyAgent` are left untouched.
- *
- * Usage: jscodeshift -t .jscodeshift/repo/bsky-agent.js <file-path>
- * Example: jscodeshift -t .jscodeshift/repo/bsky-agent.js src/lib/moderation.ts
- */
-
-/* eslint-disable */
-
-export const parser = 'tsx'
-
-export default function transformer(file, api) {
-  const j = api.jscodeshift
-  const root = j(file.source)
-
-  // Replace every standalone `BskyAgent` identifier with `AtpAgent`. This
-  // covers imports, type references, member expressions, `extends`, and `new`.
-  root
-    .find(j.Identifier, {name: 'BskyAgent'})
-    .replaceWith(() => j.identifier('AtpAgent'))
-
-  // Renaming can leave a duplicate `AtpAgent` specifier on the @atproto/api
-  // import if the file already imported it. Dedupe by imported name, keeping
-  // the type-only modifier only if every duplicate was type-only.
-  root
-    .find(j.ImportDeclaration, {source: {value: '@atproto/api'}})
-    .forEach(path => {
-      const seen = new Map()
-      for (const spec of path.value.specifiers) {
-        if (spec.type !== 'ImportSpecifier') {
-          seen.set(Symbol(), spec)
-          continue
-        }
-        const name = spec.imported.name
-        const existing = seen.get(name)
-        if (!existing) {
-          seen.set(name, spec)
-        } else if (
-          existing.importKind === 'type' &&
-          spec.importKind !== 'type'
-        ) {
-          // Prefer the value (non-type) import if either usage needs it.
-          seen.set(name, spec)
-        }
-      }
-      path.value.specifiers = Array.from(seen.values())
-    })
-
-  return root.toSource()
-}
@@ -1,135 +0,0 @@
-/**
- * Codemod to replace namespaced React calls with named imports
- *
- * Before:
- *   import React from 'react'
- *   React.useEffect(() => {}, [])
- *
- * After:
- *   import { useEffect } from 'react'
- *   useEffect(() => {}, [])
- *
- * Usage: jscodeshift -t .jscodeshift/repo/react-import.js <file-path>
- * Example: jscodeshift -t .jscodeshift/repo/react-import.js src/App.native.tsx
- */
-
-/* eslint-disable */
-
-export const parser = 'tsx'
-
-export default function transformer(file, api) {
-  const j = api.jscodeshift
-  const root = j(file.source)
-
-  // Find the React import
-  let reactImportPath = null
-  const reactMembers = new Set()
-
-  root.find(j.ImportDeclaration).forEach(path => {
-    const node = path.value
-    if (node.source.value === 'react') {
-      node.specifiers.forEach(spec => {
-        // Check if this is a default import of React
-        if (
-          spec.type === 'ImportDefaultSpecifier' &&
-          spec.local.name === 'React'
-        ) {
-          reactImportPath = path
-        }
-      })
-    }
-  })
-
-  if (!reactImportPath) {
-    // No React import found, nothing to do
-    return file.source
-  }
-
-  // Find all React.* member expressions
-  root
-    .find(j.MemberExpression)
-    .filter(path => {
-      const node = path.value
-      return (
-        node.object.type === 'Identifier' &&
-        node.object.name === 'React' &&
-        node.property.type === 'Identifier'
-      )
-    })
-    .forEach(path => {
-      const propertyName = path.value.property.name
-      reactMembers.add(propertyName)
-    })
-
-  // Find all React.* JSX member expressions (e.g., <React.Fragment>)
-  root
-    .find(j.JSXMemberExpression)
-    .filter(path => {
-      const node = path.value
-      return node.object.name === 'React' && node.property.name
-    })
-    .forEach(path => {
-      const propertyName = path.value.property.name
-      reactMembers.add(propertyName)
-    })
-
-  // If no React members are used, remove the import
-  if (reactMembers.size === 0) {
-    reactImportPath.prune()
-    return root.toSource()
-  }
-
-  // Sort the members for consistent output
-  const sortedMembers = Array.from(reactMembers).sort()
-
-  // Create new import specifiers
-  const newSpecifiers = sortedMembers.map(name =>
-    j.importSpecifier(j.identifier(name), j.identifier(name)),
-  )
-
-  // Get the existing import specifiers
-  const sortedImports = Array.from(reactImportPath.value.specifiers).sort()
-  const existingSpecifiers = sortedImports.filter(
-    specifier => specifier.type !== 'ImportDefaultSpecifier',
-  )
-
-  const allSpecifiers = [
-    ...new Map(
-      [...existingSpecifiers, ...newSpecifiers].map(item => [
-        item.imported.name,
-        item,
-      ]),
-    ).values(),
-  ]
-
-  // Update the import declaration
-  reactImportPath.value.specifiers = allSpecifiers
-
-  // Replace all React.* member expressions with just the identifier
-  root
-    .find(j.MemberExpression)
-    .filter(path => {
-      const node = path.value
-      return (
-        node.object.type === 'Identifier' &&
-        node.object.name === 'React' &&
-        node.property.type === 'Identifier'
-      )
-    })
-    .replaceWith(path => {
-      return j.identifier(path.value.property.name)
-    })
-
-  // Replace all React.* JSX member expressions with just the identifier
-  root
-    .find(j.JSXMemberExpression)
-    .filter(path => {
-      const node = path.value
-      return node.object.name === 'React' && node.property.name
-    })
-    .replaceWith(path => {
-      return j.jsxIdentifier(path.value.property.name)
-    })
-
-  return root.toSource()
-}
@@ -1,106 +0,0 @@
-/**
- * Codemod to replace namespaced React calls with named imports
- *
- * Before:
- *   import * as Toast from '#/view/com/util/Toast'
- *   Toast.show(message, 'xmark')
- *
- * After:
- *   import * as Toast from '#/components/Toast'
- *   Toast.show(message, {type: 'error'})
- *
- * Usage: jscodeshift -t .jscodeshift/repo/toast-v2.js <file-path>
- * Example: jscodeshift -t .jscodeshift/repo/toast-v2.js src/App.native.tsx
- */
-
-/* eslint-disable */
-
-export const parser = 'tsx'
-
-const OLD_IMPORT = '#/view/com/util/Toast'
-const NEW_IMPORT = '#/components/Toast'
-
-const convertLegacyToastType = type => {
-  switch (type) {
-    // these ones are fine
-    case 'default':
-    case 'success':
-    case 'error':
-    case 'warning':
-    case 'info':
-      return type
-    // legacy ones need conversion
-    case 'xmark':
-      return 'error'
-    case 'exclamation-circle':
-      return 'warning'
-    case 'check':
-      return 'success'
-    case 'clipboard-check':
-      return 'success'
-    case 'circle-exclamation':
-    case 'exclamation-circle':
-      return 'warning'
-    default:
-      return 'default'
-  }
-}
-
-export default function transformer(file, api) {
-  const j = api.jscodeshift
-  const root = j(file.source)
-
-  // Find Toast import declarations using the old path
-  const toastImports = root
-    .find(j.ImportDeclaration)
-    .filter(path => path.value.source.value === OLD_IMPORT)
-
-  if (toastImports.length === 0) {
-    return file.source
-  }
-
-  // Update import path
-  toastImports.forEach(path => {
-    path.value.source.value = NEW_IMPORT
-  })
-
-  // Collect all local names the Toast namespace is bound to
-  const toastLocalNames = new Set()
-  toastImports.forEach(path => {
-    path.value.specifiers.forEach(spec => {
-      if (spec.type === 'ImportNamespaceSpecifier') {
-        toastLocalNames.add(spec.local.name)
-      }
-    })
-  })
-
-  // Transform Toast.show(message, type) calls
-  root.find(j.CallExpression).forEach(path => {
-    const {callee, arguments: args} = path.value
-
-    // Match <ToastName>.show(...)
-    if (
-      callee.type !== 'MemberExpression' ||
-      callee.object.type !== 'Identifier' ||
-      !toastLocalNames.has(callee.object.name) ||
-      callee.property.name !== 'show'
-    ) {
-      return
-    }
-
-    // Only transform 2-arg calls where the second arg is a string literal
-    if (args.length !== 2) return
-    const typeArg = args[1]
-    if (typeArg.type !== 'StringLiteral' && typeArg.type !== 'Literal') return
-
-    const legacyType = typeArg.value
-    const newType = convertLegacyToastType(legacyType)
-
-    // Replace the second argument with an options object: {type: 'newType'}
-    args[1] = j.objectExpression([
-      j.property('init', j.identifier('type'), j.stringLiteral(newType)),
-    ])
-  })
-
-  return root.toSource()
-}
@@ -1 +1 @@
-24.18.0
+20
@@ -1,407 +0,0 @@
-{
-  "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": [
-    "typescript",
-    "react",
-    "import"
-  ],
-  "categories": {
-    "correctness": "off"
-  },
-  "options": {
-    "typeAware": true
-  },
-  "env": {
-    "builtin": true
-  },
-  "settings": {
-    "import-x/extensions": [
-      ".ts",
-      ".tsx",
-      ".cts",
-      ".mts",
-      ".js",
-      ".jsx",
-      ".cjs",
-      ".mjs"
-    ],
-    "import-x/external-module-folders": [
-      "node_modules",
-      "node_modules/@types"
-    ],
-    "import-x/parsers": {
-      "@typescript-eslint/parser": [
-        ".ts",
-        ".tsx",
-        ".cts",
-        ".mts"
-      ]
-    },
-    "import-x/resolver": {
-      "node": {
-        "extensions": [
-          ".js",
-          ".web.js",
-          ".ios.js",
-          ".android.js"
-        ]
-      }
-    }
-  },
-  "ignorePatterns": [
-    "**/__mocks__/*.ts",
-    "ios/**",
-    "android/**",
-    "coverage/**",
-    "*.lock",
-    ".husky/**",
-    "patches/**",
-    "*.html",
-    "bskyweb/**",
-    "bskyembed/**",
-    "bskyogcard/**",
-    "src/locale/locales/_build/**",
-    "src/locale/locales/**/*.js",
-    "*.e2e.ts",
-    "*.e2e.tsx",
-    "eslint.config.mjs",
-    ".jscodeshift/**"
-  ],
-  "rules": {
-    "constructor-super": "error",
-    "for-direction": "error",
-    "getter-return": "error",
-    "no-async-promise-executor": "error",
-    "no-case-declarations": "error",
-    "no-class-assign": "error",
-    "no-compare-neg-zero": "error",
-    "no-cond-assign": "error",
-    "no-const-assign": "error",
-    "no-constant-binary-expression": "error",
-    "no-constant-condition": "error",
-    "no-control-regex": "error",
-    "no-debugger": "error",
-    "no-delete-var": "error",
-    "no-dupe-class-members": "error",
-    "no-dupe-else-if": "error",
-    "no-dupe-keys": "error",
-    "no-duplicate-case": "error",
-    "no-empty": "error",
-    "no-empty-character-class": "error",
-    "no-empty-pattern": "error",
-    "no-empty-static-block": "error",
-    "no-ex-assign": "error",
-    "no-extra-boolean-cast": "error",
-    "no-fallthrough": "error",
-    "no-func-assign": "error",
-    "no-global-assign": "error",
-    "no-import-assign": "error",
-    "no-invalid-regexp": "error",
-    "no-irregular-whitespace": "error",
-    "no-loss-of-precision": "error",
-    "no-misleading-character-class": "error",
-    "no-new-native-nonconstructor": "error",
-    "no-nonoctal-decimal-escape": "error",
-    "no-obj-calls": "error",
-    "no-prototype-builtins": "error",
-    "no-redeclare": "error",
-    "no-regex-spaces": "error",
-    "no-self-assign": "error",
-    "no-setter-return": "error",
-    "no-shadow-restricted-names": "error",
-    "no-sparse-arrays": "error",
-    "no-this-before-super": "error",
-    "no-unexpected-multiline": "error",
-    "no-unreachable": "error",
-    "no-unsafe-finally": "error",
-    "no-unsafe-negation": "error",
-    "no-unsafe-optional-chaining": "error",
-    "no-unused-labels": "error",
-    "no-unused-private-class-members": "error",
-    "no-unused-vars": "error",
-    "no-useless-backreference": "error",
-    "no-useless-catch": "error",
-    "no-useless-escape": "error",
-    "no-with": "error",
-    "require-yield": "error",
-    "use-isnan": "error",
-    "valid-typeof": "error",
-    "no-array-constructor": "error",
-    "no-unused-expressions": "error",
-    "import/namespace": "off",
-    "import/default": "error",
-    "import/no-named-as-default": "warn",
-    "import/no-named-as-default-member": "warn",
-    "import/no-duplicates": "warn",
-    "react/rules-of-hooks": "error",
-    "react/exhaustive-deps": "warn",
-    "typescript/await-thenable": "error",
-    "typescript/ban-ts-comment": "error",
-    "typescript/no-array-delete": "error",
-    "typescript/no-base-to-string": "error",
-    "typescript/no-duplicate-enum-values": "error",
-    "typescript/no-duplicate-type-constituents": "error",
-    "typescript/no-empty-object-type": "error",
-    "typescript/no-explicit-any": "error",
-    "typescript/no-extra-non-null-assertion": "error",
-    "typescript/no-floating-promises": "error",
-    "typescript/no-for-in-array": "error",
-    "typescript/no-implied-eval": "error",
-    "typescript/no-misused-new": "error",
-    "typescript/no-misused-promises": "error",
-    "typescript/no-namespace": "error",
-    "typescript/no-non-null-asserted-optional-chain": "error",
-    "typescript/no-redundant-type-constituents": "error",
-    "typescript/no-require-imports": "error",
-    "typescript/no-this-alias": "error",
-    "typescript/no-unnecessary-type-assertion": "error",
-    "typescript/no-unnecessary-type-constraint": "error",
-    "typescript/no-unsafe-argument": "error",
-    "typescript/no-unsafe-assignment": "error",
-    "typescript/no-unsafe-call": "error",
-    "typescript/no-unsafe-declaration-merging": "error",
-    "typescript/no-unsafe-enum-comparison": "error",
-    "typescript/no-unsafe-function-type": "error",
-    "typescript/no-unsafe-member-access": "error",
-    "typescript/no-unsafe-return": "error",
-    "typescript/no-unsafe-unary-minus": "error",
-    "typescript/no-wrapper-object-types": "error",
-    "typescript/only-throw-error": "error",
-    "typescript/prefer-as-const": "error",
-    "typescript/prefer-namespace-keyword": "error",
-    "typescript/prefer-promise-reject-errors": "error",
-    "typescript/require-await": "error",
-    "typescript/restrict-plus-operands": "error",
-    "typescript/restrict-template-expressions": "error",
-    "typescript/triple-slash-reference": "error",
-    "typescript/unbound-method": "error"
-  },
-  "overrides": [
-    {
-      "files": [
-        "**/*.ts",
-        "**/*.tsx",
-        "**/*.mts",
-        "**/*.cts"
-      ],
-      "rules": {
-        "constructor-super": "off",
-        "getter-return": "off",
-        "no-class-assign": "off",
-        "no-const-assign": "off",
-        "no-dupe-class-members": "off",
-        "no-dupe-keys": "off",
-        "no-func-assign": "off",
-        "no-import-assign": "off",
-        "no-new-native-nonconstructor": "off",
-        "no-obj-calls": "off",
-        "no-redeclare": "off",
-        "no-setter-return": "off",
-        "no-this-before-super": "off",
-        "no-unreachable": "off",
-        "no-unsafe-negation": "off",
-        "no-var": "error",
-        "no-with": "off",
-        "prefer-const": "error",
-        "prefer-rest-params": "error",
-        "prefer-spread": "error"
-      }
-    },
-    {
-      "files": [
-        "**/*.{js,jsx,ts,tsx}"
-      ],
-      "rules": {
-        "bsky-internal/avoid-unwrapped-text": [
-          "error",
-          {
-            "impliedTextComponents": [
-              "H1",
-              "H2",
-              "H3",
-              "H4",
-              "H5",
-              "H6",
-              "P",
-              "Admonition",
-              "Admonition.Admonition",
-              "Toast.Action",
-              "AgeAssuranceAdmonition",
-              "Span",
-              "StackedButton"
-            ],
-            "impliedTextProps": [],
-            "suggestedTextWrappers": {
-              "Button": "ButtonText",
-              "ToggleButton.Button": "ToggleButton.ButtonText",
-              "SegmentedControl.Item": "SegmentedControl.ItemText"
-            }
-          }
-        ],
-        "bsky-internal/use-exact-imports": "error",
-        "bsky-internal/use-prefixed-imports": "error",
-        "bsky-internal/lingui-msg-rule": "error",
-        "react/display-name": "error",
-        "react/jsx-key": "error",
-        "react/jsx-no-comment-textnodes": "error",
-        "react/jsx-no-duplicate-props": "error",
-        "react/jsx-no-target-blank": "error",
-        "react/jsx-no-undef": "error",
-        "react/no-children-prop": "error",
-        "react/no-danger-with-children": "error",
-        "react/no-direct-mutation-state": "error",
-        "react/no-find-dom-node": "error",
-        "react/no-is-mounted": "error",
-        "react/no-render-return-value": "error",
-        "react/no-string-refs": "error",
-        "react/no-unescaped-entities": "off",
-        "react/no-unknown-property": "error",
-        "react/no-unsafe": "off",
-        "react/react-in-jsx-scope": "off",
-        "react/hook-use-state": "warn",
-        "react-native/no-inline-styles": "off",
-        "react-native-a11y/has-accessibility-hint": "error",
-        "react-native-a11y/has-accessibility-props": "error",
-        "react-native-a11y/has-valid-accessibility-actions": "error",
-        "react-native-a11y/has-valid-accessibility-component-type": "error",
-        "react-native-a11y/has-valid-accessibility-descriptors": "error",
-        "react-native-a11y/has-valid-accessibility-role": "error",
-        "react-native-a11y/has-valid-accessibility-state": "error",
-        "react-native-a11y/has-valid-accessibility-states": "error",
-        "react-native-a11y/has-valid-accessibility-traits": "error",
-        "react-native-a11y/has-valid-accessibility-value": "error",
-        "react-native-a11y/no-nested-touchables": "error",
-        "react-native-a11y/has-valid-accessibility-ignores-invert-colors": "error",
-        "react-native-a11y/has-valid-accessibility-live-region": "error",
-        "react-native-a11y/has-valid-important-for-accessibility": "error",
-        "react-compiler/react-compiler": "warn",
-        "simple-import-sort/imports": [
-          "error",
-          {
-            "groups": [
-              [
-                "^\\u0000"
-              ],
-              [
-                "^node:"
-              ],
-              [
-                "^(react\\/(.*)$)|^(react$)|^(react-native(.*)$)",
-                "^(expo(.*)$)|^(expo$)",
-                "^(?!(?:alf|components|lib|locale|logger|platform|screens|state|view)(?:$|\\/))@?\\w"
-              ],
-              [
-                "^(?:#\\/)?(?:lib|state|logger|platform|locale)(?:$|\\/)",
-                "^(?:#\\/)?view(?:$|\\/)",
-                "^(?:#\\/)?screens(?:$|\\/)",
-                "^(?:#\\/)?alf(?:$|\\/)",
-                "^(?:#\\/)?components(?:$|\\/)",
-                "^#\\/",
-                "^\\."
-              ],
-              [
-                "^"
-              ]
-            ]
-          }
-        ],
-        "simple-import-sort/exports": "error",
-        "no-unused-vars": [
-          "error",
-          {
-            "argsIgnorePattern": "^_",
-            "varsIgnorePattern": "^_.+",
-            "caughtErrors": "none",
-            "ignoreRestSiblings": true
-          }
-        ],
-        "no-restricted-imports": [
-          "error",
-          {
-            "paths": [
-              {
-                "name": "react",
-                "importNames": [
-                  "React",
-                  "default"
-                ],
-                "message": "React is already in the global type namespace. Use named imports for runtime modules."
-              }
-            ]
-          }
-        ],
-        "no-empty-pattern": "off",
-        "no-async-promise-executor": "off",
-        "no-constant-binary-expression": "warn",
-        "prefer-const": "off",
-        "no-empty": "off",
-        "no-unsafe-optional-chaining": "off",
-        "no-prototype-builtins": "off",
-        "no-var": "off",
-        "prefer-rest-params": "off",
-        "no-case-declarations": "off",
-        "no-irregular-whitespace": "off",
-        "no-useless-escape": "off",
-        "no-sparse-arrays": "off",
-        "no-fallthrough": "off",
-        "no-control-regex": "off",
-        "no-unused-expressions": [
-          "error",
-          {
-            "allowTernary": true
-          }
-        ],
-        "import/consistent-type-specifier-style": [
-          "warn",
-          "prefer-inline"
-        ],
-        "import/no-nodejs-modules": "error",
-        "typescript/consistent-type-imports": [
-          "warn",
-          {
-            "prefer": "type-imports",
-            "fixStyle": "inline-type-imports"
-          }
-        ],
-        "typescript/no-require-imports": "off",
-        "typescript/ban-ts-comment": "off",
-        "typescript/no-empty-object-type": "off",
-        "typescript/no-unsafe-function-type": "off",
-        "typescript/no-unsafe-assignment": "off",
-        "typescript/unbound-method": "off",
-        "typescript/no-unsafe-argument": "off",
-        "typescript/no-unsafe-return": "off"
-      },
-      "jsPlugins": [
-        "eslint-plugin-bsky-internal",
-        "eslint-plugin-react-native",
-        "eslint-plugin-react-native-a11y",
-        "eslint-plugin-react-compiler",
-        "eslint-plugin-simple-import-sort"
-      ],
-      "env": {
-        "es2026": true,
-        "browser": true,
-        "node": true
-      }
-    },
-    {
-      "files": [
-        "bskyogcard/**/*.{js,jsx,ts,tsx}",
-        "dev-env/**/*.{js,jsx,ts,tsx}"
-      ],
-      "rules": {
-        "import/no-nodejs-modules": "off"
-      }
-    },
-    {
-      "files": [
-        "**/__tests__/**/*.{js,jsx,ts,tsx}",
-        "**/*.test.{js,jsx,ts,tsx}"
-      ],
-      "env": {
-        "jest": true
-      }
-    }
-  ]
-}
@@ -5,14 +5,10 @@
 !**/*.jsx
 !**/*.ts
 !**/*.tsx
-!**/*.mjs
-!**/*.cjs
 !*/

 !**/*.css

-!**/pnpm-workspace.yaml
-
 # More specific ignores go below.
 .expo
 android
@@ -1,6 +1,4 @@
-import {type Config} from 'prettier'
-
-const config: Config = {
+module.exports = {
  semi: false,
  arrowParens: 'avoid',
  bracketSameLine: true,
@@ -8,5 +6,3 @@ const config: Config = {
  singleQuote: true,
  trailingComma: 'all',
 }
-
-export default config
@@ -1,580 +0,0 @@
-# CLAUDE.md – Bluesky Social App Development Guide
-
-This document provides guidance for working effectively in the Bluesky Social app codebase.
-
-## Project Overview
-
-Bluesky Social is a cross-platform social media application built with React Native and Expo. It runs on iOS, Android, and Web, connecting to the AT Protocol (atproto) decentralized social network.
-
-**Tech Stack:**
-
- React 19.1
- React Native 0.81 with Expo 54
- TypeScript 7
- React Navigation 7 for routing
- TanStack Query (React Query) for data fetching
- Lingui 5 for internationalization
- Custom design system called ALF (Application Layout Framework)
-
-Prefer using the latest features available for each of these libraries (exact versions are found in `package.json`). For example, prefer `@lingui/react/macro` over `@lingui/react`. Suggest refactoring legacy or deprecated uses.
-
-## Essential Commands
-
-```bash
-# Development
-pnpm start              # Start Expo dev server
-pnpm web                # Start web version
-pnpm android            # Run on Android
-pnpm ios                # Run on iOS
-
-# Testing & Quality
-# IMPORTANT: Always use these pnpm scripts, never call the underlying tools directly
-pnpm test               # Run Jest tests
-pnpm lint               # Run Oxlint
-pnpm typecheck          # Run TypeScript type checking
-pnpm prettier           # Run Prettier for code formatting
-
-# Internationalization
-# DO NOT run these commands - extraction and compilation are handled by CI
-pnpm intl:extract       # Extract translation strings (nightly CI job)
-pnpm intl:compile       # Compile translations for runtime (nightly CI job)
-
-# Build
-pnpm build-web          # Build web version
-pnpm prebuild           # Generate native projects
-```
-
-## Project Structure
-
-```
-src/
-├── alf/                    # Design system (ALF) - themes, atoms, tokens
-├── components/             # Shared UI components (Button, Dialog, Menu, etc.)
-├── screens/                # Full-page screen components (newer pattern)
-├── features/               # Macro-features that bridge components/screens
-├── view/
-│   ├── screens/            # Full-page screens (legacy location)
-│   ├── com/                # Reusable view components
-│   └── shell/              # App shell (navigation bars, tabs)
-├── state/
-│   ├── queries/            # TanStack Query hooks
-│   ├── preferences/        # User preferences (React Context)
-│   ├── session/            # Authentication state
-│   └── persisted/          # Persistent storage layer
-├── lib/                    # Utilities, constants, helpers
-├── locale/                 # i18n configuration and language files
-└── Navigation.tsx          # Main navigation configuration
-```
-
-### Project Structure in Depth
-
-When building new things, follow these guidelines for where to put code.
-
-#### Components vs Screens vs Features
-
-**Components** are reusable UI elements that are not full screens. Should be
-platform-agnostic when possible. Examples: Button, Dialog, Menu, TextField. Put
-these in `/components` if they are shared across screens.
-
-**Screens** are full-page components that represent a route in the app. They
-often contain multiple components and handle layout for a page. New screens
-should go in `/screens` (not `/view/screens`) to encourage better organization
-and separation from legacy code.
-
-For complex screens that have specific components or data needs that _are not
-shared by other screens_, we encourage subdirectories within `/screens/<name>`
-e.g. `/screens/ProfileScreen/ProfileScreen.tsx` and
-`/screens/ProfileScreen/components/`.
-
-**Features** are higher-level modules that may include context, data fetching,
-components, and utilities related to a specific feature e.g.
-`/features/liveNow`. They don't neatly fit into components or screens and often
-span multiple screens. This is an optional pattern for organizing complex
-features.
-
-#### Legacy Directories
-
-For the most part, avoid writing new files into the `/view` directory and
-subdirectories. This is the older pattern for organizing screens and components,
-and it has become a bit disorganized over time. New development should go into
-`/screens`, `/components`, and `/features`.
-
-#### State
-
-The `/state` directory is where we've historically put all our data fetching and
-state management logic. This is perfectly fine, but for new features, consider
-organizing state logic closer to the components that use it, either within a
-feature directory or co-located with a screen. The key is to keep related code
-together and avoid having "god files" with too much unrelated logic.
-
-#### Lib
-
-The `/lib` directory is for utilities and helpers that don't fit into other
-categories. This can include things like API clients, formatting functions,
-constants, and other shared logic.
-
-#### Top Level Directories
-
-Avoid writing new top-level subdirectories within `/src`. We've done this for a
-few things in the past that, but we have stronger patterns now. Examples:
-`/logger` should probably have been written into `/lib`. And `ageAssurance` is
-better classified within `/features`. We will probably migrate these things
-eventually.
-
-### File and Directory Naming Conventions
-
-Typically JS style for variables, functions, etc. We use ProudCamelCase for
-components, and camelCase directories and files.
-
-For "macro" cases in `/features`, `/screens`, or `/components`, co-locate related
-code in a directory with an `index.tsx` main component plus sibling
-components/hooks/utils (e.g. `screens/ProfileScreen/index.tsx` +
-`screens/ProfileScreen/components/`). Keep related code together so it lives where
-someone would look for it. Don't overdo it: a component that fits in one file
-should just be `Component.tsx`, not `Component/index.tsx`.
-
-Platform-specific files are covered under "Platform-Specific Code" below.
-
-### Comments
-
-Comment code when necessary to explain the “why” behind something; avoid
-comments that simply describe the code. Avoid Unicode characters in comments,
-e.g., use `-` not `—`.
-
-Always use docblock (`/** */`) syntax for comments that document a type, type
-member, method, function, or variable. These are the comments a reader expects
-to find attached to a named declaration, and the docblock form makes that intent
-clear and surfaces nicely in editor tooltips.
-
-```tsx
-type DateFieldProps = {
-  /**
-   * An empty string renders the placeholder and opens the picker at today (or
-   * maximumDate, if earlier).
-   */
-  value: string | Date
-}
-
-/**
- * Date-only input. Accepts a string in the format YYYY-MM-DD, or a Date object.
- */
-export function DateField() {}
-```
-
-More generally, any multiline comment should use the `/* */` block syntax rather
-than stacked `//` lines. Reserve `//` for short, single-line comments.
-
-```tsx
-/*
- * The picker requires a valid date, so when value is empty we fall back to
- * maximumDate (if set) or today.
- */
-const fallbackDate = maximumDate ? toSimpleDateString(maximumDate) : today
-```
-
-### Documentation and Tests Within Features
-
-For larger features or components, co-locate documentation and tests with the
-code. A `README.md` in the directory (the `/Component/index.tsx` pattern lends
-itself well to this) can document the whole feature, and feature-specific tests
-belong alongside it as `Component.test.tsx` or in a `__tests__/` subdirectory.
-Both are optional.
-
-## Styling System (ALF)
-
-ALF is the custom design system. Tailwind-inspired naming with underscores
-instead of hyphens. Static atoms (`atoms as a`) are theme-independent; theme
-atoms/palette come from `useTheme()` (`t.atoms.bg`, `t.palette.primary_500`).
-Style props take an array of atoms + theme atoms + raw styles.
-
-Order atoms by: flexbox (`a.flex_row`), spacing (`a.px_md`), text (`a.font_bold`),
-themes (`t.atoms.text`), then raw styles (`{backgroundColor: t.palette.primary_500}`).
-
-```tsx
-import {atoms as a, useTheme} from '#/alf'
-
-const t = useTheme()
-<View style={[a.flex_row, a.gap_md, a.p_lg, t.atoms.bg]} />
-```
-
-### Key Concepts
-
-Static atoms live in `a.*` (e.g. `a.flex_row`, `a.p_md`, `a.rounded_md`,
-`a.text_lg`). Theme atoms/palette come from `useTheme()` (`t.atoms.bg`,
-`t.atoms.text`, `t.atoms.border_contrast_low`, `t.palette.primary_500`).
-
-**Platform utilities** (`import {web, native, ios, android, platform} from '#/alf'`)
-return conditional styles inline in a style array: `web({cursor: 'pointer'})`,
-`native({paddingBottom: 20})`, `platform({ios: {...}, android: {...}, web: {...}})`.
-
-**Breakpoints:** `const {gtPhone, gtMobile, gtTablet} = useBreakpoints()` from `#/alf`.
-
-### Naming Conventions
-
- Spacing: `2xs`, `xs`, `sm`, `md`, `lg`, `xl`, `2xl` (t-shirt sizes)
- Text: `text_xs`, `text_sm`, `text_md`, `text_lg`, `text_xl`
- Gaps/Padding: `gap_sm`, `p_md`, `px_lg`, `py_xl`
- Flex: `flex_row`, `flex_1`, `align_center`, `justify_between`
- Borders: `border`, `border_t`, `rounded_md`, `rounded_full`
-
-## Component Patterns
-
- Prefer fragment shorthand over `Fragment` unless a `key` is needed.
- Prefer functions over arrow functions for component declarations.
- Prefer prop destructuring via parameters over a const within the component.
- Prefer inline types over `Props` types or interfaces.
- Set reasonable defaults for optional props.
-
-```tsx
-import {Fragment} from 'react'
-import {View} from 'react-native'
-import {Trans} from '@lingui/react/macro'
-
-import {Text} from '#/components/Typography'
-
-function MyComponent({items = []}: {items?: string[]}) {
-  return (
-    <>
-      <View>
-        <Text>
-          <Trans>Example</Trans>
-        </Text>
-      </View>
-      <View>
-        {items.map((item, index) => (
-          <Fragment key={item}>
-            <Text>{index}</Text>
-            <Text>{item}</Text>
-          </Fragment>
-        ))}
-      </View>
-    </>
-  )
-}
-```
-
-### Dialog Component
-
-Lives in `#/components/Dialog`. Bottom sheet on native, modal on web. Manage
-state with `useDialogControl()`. `Dialog.Handle` renders native-only, `Dialog.Close`
-web-only. CRITICAL: run any post-close action inside the `control.close(() => ...)`
-callback (see Footguns). Compound-component usage; canonical example in any dialog
-under `#/components`.
-
-### Menu Component
-
-Lives in `#/components/Menu`. Dropdown on web, bottom sheet dialog on native.
-`Menu.Divider` is web-only, `Menu.ContainerItem` native-only. Compound API
-(`Menu.Root` / `Menu.Trigger` / `Menu.Outer` / `Menu.Group` / `Menu.Item`); grep
-existing usages across the app for a canonical example.
-
-### Button Component
-
-`import {Button, ButtonText, ButtonIcon} from '#/components/Button'`. Props:
-
- `color`: `'primary'` | `'secondary'` | `'negative'` | `'primary_subtle'` | `'negative_subtle'` | `'secondary_inverted'`
- `size`: `'tiny'` | `'small'` | `'large'`
- `shape`: `'default'` (pill) | `'round'` | `'square'` | `'rectangular'`
- `variant`: `'solid'` | `'outline'` | `'ghost'` (deprecated, prefer `color`)
-
-### TextField
-
-Compound component at `#/components/forms/TextField` (`TextField.LabelText`,
-`TextField.Root`, `TextField.Icon`, `TextField.Input`). Prefer `defaultValue` over
-`value` (see Footguns).
-
-### Typography
-
-`import {Text, H1, H2, P} from '#/components/Typography'`. The `Text` default style
-is `[a.text_sm, a.leading_snug, t.atoms.text]`. Pass the `emoji` prop to any `Text`
-that may contain emoji - user-generated text (display names etc.) almost always
-does, so only omit it for static, emoji-free strings: `<Text emoji>Hello!</Text>`.
-
-## Internationalization (i18n)
-
-All user-facing strings must be wrapped for translation using Lingui. Include `comment` and/or `context` props when necessary to avoid ambiguity, e.g., “Post” as a noun vs a verb.
-
-Prefer using `t` via `import {useLingui} '@lingui/react/macro'` vs `_` via `import {useLingui} from '@lingui/react'`. Alias `t` to `l` to avoid collisions with `const t = useTheme()`. Refactor existing uses of ``_(msg`foo`)`` to use `` l`foo` ``.
-
-Prefer Unicode punctuation over keyboard punctuation, e.g., `“quote”` over `"quote"`. Prefer en dashes preceded by a non-breaking space over em dashes, e.g., `one – two` over `one—two`.
-
-```tsx
-import {plural} from '@lingui/core/macro'
-import {Trans, useLingui} from '@lingui/react/macro'
-
-function MyComponent() {
-  const {t: l} = useLingui()
-
-  // Simple strings - use the l macro
-  const title = l`Settings`
-  const errorMessage = l({
-    message: 'Something went wrong',
-    comment: 'Generic error message for unknown/unhandled errors.',
-    context: 'Toast',
-  })
-
-  // Strings with variables
-  const greeting = l`Hello, ${name}!`
-
-  // Pluralization
-  const countLabel = plural(count, {
-    one: '# item',
-    other: '# items',
-  })
-
-  // JSX content - use Trans component
-  return (
-    <Text>
-      <Trans>
-        Welcome to <Text style={a.font_bold}>Bluesky</Text>, {name}!
-      </Trans>
-    </Text>
-  )
-}
-```
-
-Prefer `i18n.date` for date and time formatting. This ensures formatting is re-applied when the language changes at runtime. Refactor existing uses of `Intl.DateTimeFormat` to use `i18n.date`.
-
-```tsx
-import {useLingui} from '@lingui/react/macro'
-
-function MyComponent() {
-  const {i18n} = useLingui()
-
-  const createdAt = new Date()
-
-  return i18n.date(createdAt, {
-    dateStyle: 'medium',
-    timeStyle: 'medium',
-  })
-}
-```
-
-**Commands:**
-
-```bash
-# DO NOT run these commands - extraction and compilation are handled by a nightly CI job
-pnpm intl:extract    # Extract new strings to locale files
-pnpm intl:compile    # Compile translations for runtime
-```
-
-## State Management
-
-### TanStack Query (Data Fetching)
-
-Follow the established pattern in `src/state/queries/`; `src/state/queries/feed.ts`
-is a good canonical reference (it uses `createQueryKey`, matching key roots,
-`useInfiniteQuery`, and `persistedVersion`).
-
- Build query keys with `createQueryKey(root, args)` (from `#/state/queries/util`)
-  using an object for `args`. The key root variable should match the hook name.
- Naming conventions: `use[Name]Query` for queries, `use[Name]Mutation` for
-  mutations, `use[Name]CacheMutation` for helpers that mutate cached data directly.
- Stale times come from `STALE` in `src/state/queries/index.ts`: `STALE.SECONDS.FIFTEEN`,
-  `STALE.MINUTES.ONE`, `STALE.MINUTES.FIVE`, `STALE.HOURS.ONE`, `STALE.INFINITY`.
- Paginated atproto APIs (those returning a `cursor`) use `useInfiniteQuery` with
-  `getNextPageParam: page => page.cursor`; flatten results with
-  `data?.pages.flatMap(page => page.items) ?? []`.
- Persist a query across restarts by passing options:
-  `createQueryKey(root, args, {persistedVersion: n})`. Bumping `n` clears the old
-  persisted data and refetches - do this whenever the data shape changes.
- Error handling in mutations: don't log network errors (just inform the user),
-  handle typed XRPC errors specifically (e.g. `err instanceof SomeNsid.SomeError`),
-  and send unexpected errors to `logger.error('...', {safeMessage: error})`.
-
-### Preferences (React Context)
-
-Boolean/simple UI preferences are exposed as paired hooks from `#/state/preferences`,
-e.g. `useAutoplayDisabled()` / `useSetAutoplayDisabled()`.
-
-### Session State
-
-`import {useSession, useAgent} from '#/state/session'`. `useSession()` gives
-`hasSession` and `currentAccount`; `useAgent()` gives the atproto agent for API calls.
-
-## Navigation
-
-React Navigation with type-safe route params. Type a screen with
-`NativeStackScreenProps<CommonNavigatorParams, 'X'>` (`route`/`navigation` come
-from props; params via `route.params`). Navigate programmatically with
-`useNavigation()`, or the `navigate` helper from `#/Navigation`. Config lives in
-`src/Navigation.tsx`, routes in `src/routes.ts`, types in `src/lib/routes/types.ts`.
-
-## Platform-Specific Code
-
-Use file extensions for platform-specific implementations. The bundler resolves
-them automatically - just import the base path normally, never a conditional
-`require()`.
-
-```
-Component.tsx          # Shared/default
-Component.web.tsx      # Web-only
-Component.native.tsx   # iOS + Android
-Component.ios.tsx      # iOS-only
-Component.android.tsx  # Android-only
-```
-
-Prefer grouping variants into a `Component/` directory (`index.tsx`,
-`index.web.tsx`, `index.native.tsx`) rather than sibling `Component.web.tsx` files,
-so the shared surface reads as one "macro" module (e.g. `src/components/Dialog/index.tsx`
-native vs `index.web.tsx` web). The app has both patterns; the directory form is
-preferred for new code.
-
-```tsx
-// CORRECT - bundler picks storage.ts or storage.web.ts automatically
-import * as storage from '#/state/drafts/storage'
-
-// WRONG - don't use require() or conditional imports for platform files
-const storage = IS_NATIVE
-  ? require('#/state/drafts/storage')
-  : require('#/state/drafts/storage.web')
-```
-
-Runtime platform detection (not for imports): `import {IS_WEB, IS_NATIVE, IS_IOS, IS_ANDROID} from '#/env'`.
-
-## Import Aliases
-
-Always use the `#/` alias for absolute imports:
-
-```tsx
-// Good
-import {useSession} from '#/state/session'
-import {atoms as a, useTheme} from '#/alf'
-import {Button} from '#/components/Button'
-
-// Avoid
-import {useSession} from '../../../state/session'
-```
-
-## Footguns
-
-Common pitfalls to avoid in this codebase:
-
-### Dialog Close Callback (Critical)
-
-**Always use `control.close(() => ...)` when performing actions after closing a dialog.** The callback ensures the action runs after the dialog's close animation completes. Failing to do this causes race conditions with React state updates.
-
-```tsx
-// WRONG - causes bugs with state updates, navigation, opening other dialogs
-const onConfirm = () => {
-  control.close()
-  navigation.navigate('Home') // May race with dialog animation
-}
-
-// WRONG - same problem
-const onConfirm = () => {
-  control.close()
-  otherDialogControl.open() // Will likely fail or cause visual glitches
-}
-
-// CORRECT - action runs after dialog fully closes
-const onConfirm = () => {
-  control.close(() => {
-    navigation.navigate('Home')
-  })
-}
-
-// CORRECT - opening another dialog after close
-const onConfirm = () => {
-  control.close(() => {
-    otherDialogControl.open()
-  })
-}
-
-// CORRECT - state updates after close
-const onConfirm = () => {
-  control.close(() => {
-    setSomeState(newValue)
-    onCallback?.()
-  })
-}
-```
-
-This applies to:
-
- Navigation (`navigation.navigate()`, `navigation.push()`)
- Opening other dialogs or menus
- State updates that affect UI (`setState`, `queryClient.invalidateQueries`)
- Callbacks passed from parent components
-
-The Menu component on iOS specifically uses this pattern – see `src/components/Menu/index.tsx:151`.
-
-### Controlled vs Uncontrolled Inputs
-
-Prefer `defaultValue` over `value` for TextInput on the old architecture:
-
-```tsx
-// Preferred - uncontrolled
-<TextField.Input
-  defaultValue={initialEmail}
-  onChangeText={setEmail}
-/>
-
-// Avoid when possible - controlled (can cause performance issues)
-<TextField.Input
-  value={email}
-  onChangeText={setEmail}
-/>
-```
-
-### Platform-Specific Behavior
-
-Some components behave differently across platforms:
-
- `Dialog.Handle` – Only renders on native (drag handle for bottom sheet)
- `Dialog.Close` – Only renders on web (X button)
- `Menu.Divider` – Only renders on web
- `Menu.ContainerItem` – Only works on native
-
-Always test on multiple platforms when using these components.
-
-### React Compiler is Enabled
-
-This codebase uses React Compiler, so **don't proactively add `useMemo` or `useCallback`**. The compiler handles memoization automatically.
-
-```tsx
-// UNNECESSARY - React Compiler handles this
-const handlePress = useCallback(() => {
-  doSomething()
-}, [doSomething])
-
-// JUST WRITE THIS
-const handlePress = () => {
-  doSomething()
-}
-```
-
-Only use `useMemo`/`useCallback` when you have a specific reason, such as:
-
- The value is immediately used in an effect's dependency array
- You're passing a callback to a non-React library that needs referential stability
-
-## Best Practices
-
-1. **Accessibility**: Always provide `label` prop for interactive elements, use `accessibilityHint` where helpful
-
-2. **Translations**: Wrap ALL user-facing strings with ` `l` `` or `<Trans>`
-
-3. **Styling**: Combine static atoms with theme atoms, use platform utilities for platform-specific styles
-
-4. **State**: Use TanStack Query for server state, React Context for UI preferences
-
-5. **Components**: Check if a component exists in `#/components/` before creating new ones
-
-6. **Types**: Define explicit types for props, use `NativeStackScreenProps` for screens
-
-7. **Testing**: Components should have `testID` props for E2E testing
-
-## Key Files Reference
-
-| Purpose           | Location                                     |
-| ----------------- | -------------------------------------------- |
-| Theme definitions | `src/alf/themes.ts`                          |
-| Design tokens     | `src/alf/tokens.ts`                          |
-| Static atoms      | `src/alf/atoms.ts` (extends `@bsky.app/alf`) |
-| Navigation config | `src/Navigation.tsx`                         |
-| Route definitions | `src/routes.ts`                              |
-| Route types       | `src/lib/routes/types.ts`                    |
-| Query hooks       | `src/state/queries/*.ts`                     |
-| Session state     | `src/state/session/index.tsx`                |
-| i18n setup        | `src/locale/i18n.ts`                         |
@@ -1,87 +1,52 @@
-#
-# Stage 1: build the web bundle with pnpm.
-#
-# Uses the official pnpm image. Node is auto-downloaded by pnpm using the
-# `devEngines.runtime` field in package.json (onFail: "download").
-#
-FROM ghcr.io/pnpm/pnpm:11 AS web-build
-
-WORKDIR /app
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-#
-# pnpm config
-#
-ENV CI=1
-# use the pnpm version specified in package.json
-ENV pnpm_config_pm_on_fail=download
-
-# The latest git hash of the preview branch on render.com
-# https://render.com/docs/docker-secrets#environment-variables-in-docker-builds
-ARG RENDER_GIT_COMMIT
-
-#
-# Expo
-#
-ARG EXPO_PUBLIC_ENV
-ENV EXPO_PUBLIC_ENV=${EXPO_PUBLIC_ENV:-development}
-ARG EXPO_PUBLIC_RELEASE_VERSION
-ENV EXPO_PUBLIC_RELEASE_VERSION=$EXPO_PUBLIC_RELEASE_VERSION
-ARG EXPO_PUBLIC_BUNDLE_IDENTIFIER
-# If not set by GitHub workflows, we're probably in Render
-ENV EXPO_PUBLIC_BUNDLE_IDENTIFIER=${EXPO_PUBLIC_BUNDLE_IDENTIFIER:-$RENDER_GIT_COMMIT}
-
-#
-# Sentry
-#
-ARG SENTRY_AUTH_TOKEN
-ENV SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN:-unknown}
-ARG EXPO_PUBLIC_SENTRY_DSN
-ENV EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN
-
-COPY . .
-
-RUN echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
-  echo "EXPO_PUBLIC_ENV=$EXPO_PUBLIC_ENV" >> .env && \
-  echo "EXPO_PUBLIC_RELEASE_VERSION=$EXPO_PUBLIC_RELEASE_VERSION" >> .env && \
-  echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$EXPO_PUBLIC_BUNDLE_IDENTIFIER" >> .env && \
-  echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env && \
-  echo "EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN" >> .env
-
-RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
-
-RUN pnpm intl:build 2>&1 | tee i18n.log && \
-  if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compile errors!\n\n"; fi
-
-RUN SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN \
-    SENTRY_RELEASE=$EXPO_PUBLIC_RELEASE_VERSION \
-    SENTRY_DIST=$EXPO_PUBLIC_BUNDLE_IDENTIFIER \
-    pnpm build-web
-
-#
-# Stage 2: build the bskyweb Go binary, embedding the assets from stage 1.
-#
-# post-web-build.js (run by `pnpm build-web`) writes the bundled JS/CSS/media
-# into bskyweb/static/* and regenerates bskyweb/templates/scripts.html, so
-# copying the bskyweb/ tree from stage 1 is enough for go:embed to find
-# everything.
-#
-FROM golang:1.26-bookworm AS go-build
+FROM golang:1.23-bullseye AS build-env

 WORKDIR /usr/src/social-app

+ENV DEBIAN_FRONTEND=noninteractive
+
+# Node
+ENV NODE_VERSION=20
+ENV NVM_DIR=/usr/share/nvm
+
+# Go
 ENV GODEBUG="netdns=go"
 ENV GOOS="linux"
 ENV GOARCH="amd64"
 ENV CGO_ENABLED=1
 ENV GOEXPERIMENT="loopvar"

-COPY --from=web-build /app/bskyweb ./bskyweb
+# Expo
+ARG EXPO_PUBLIC_BUNDLE_IDENTIFIER
+ENV EXPO_PUBLIC_BUNDLE_IDENTIFIER=${EXPO_PUBLIC_BUNDLE_IDENTIFIER:-dev}
+
+COPY . .
+
+#
+# Generate the JavaScript webpack.
+#
+RUN mkdir --parents $NVM_DIR && \
+  wget \
+    --output-document=/tmp/nvm-install.sh \
+    https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh && \
+  bash /tmp/nvm-install.sh
+
+RUN \. "$NVM_DIR/nvm.sh" && \
+  nvm install $NODE_VERSION && \
+  nvm use $NODE_VERSION && \
+  echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
+  echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$EXPO_PUBLIC_BUNDLE_IDENTIFIER" >> .env && \
+  echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env && \
+  npm install --global yarn && \
+  yarn && \
+  yarn intl:build && \
+  EXPO_PUBLIC_BUNDLE_IDENTIFIER=$EXPO_PUBLIC_BUNDLE_IDENTIFIER EXPO_PUBLIC_BUNDLE_DATE=$() yarn build-web

 # DEBUG
-RUN find ./bskyweb/static
+RUN find ./bskyweb/static && find ./web-build/static

+#
+# Generate the bskyweb Go binary.
+#
 RUN cd bskyweb/ && \
  go mod download && \
  go mod verify
@@ -94,10 +59,7 @@ RUN cd bskyweb/ && \
    -o /bskyweb \
    ./cmd/bskyweb

-#
-# Stage 3: runtime image.
-#
-FROM debian:bookworm-slim
+FROM debian:bullseye-slim

 ENV GODEBUG=netdns=go
 ENV TZ=Etc/UTC
@@ -110,7 +72,7 @@ RUN apt-get update && apt-get install --yes \
 ENTRYPOINT ["dumb-init", "--"]

 WORKDIR /bskyweb
-COPY --from=go-build /bskyweb /usr/bin/bskyweb
+COPY --from=build-env /bskyweb /usr/bin/bskyweb

 CMD ["/usr/bin/bskyweb"]

@@ -1,4 +1,4 @@
-FROM node:24.18.0-alpine3.23 AS build
+FROM node:20.11-alpine3.18 as build

 # Move files into the image and install
 WORKDIR /app
@@ -14,7 +14,7 @@ RUN yarn build
 RUN yarn install --production --ignore-scripts --prefer-offline

 # Uses assets from build stage to reduce build size
-FROM node:24.18.0-alpine3.23
+FROM node:20.11-alpine3.18

 RUN apk add --update dumb-init

@@ -29,6 +29,8 @@ VOLUME /app/data
 EXPOSE 3000
 ENV LINK_PORT=3000
 ENV NODE_ENV=production
+# potential perf issues w/ io_uring on this version of node
+ENV UV_USE_IO_URING=0

 # https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user
 USER node
@@ -1,25 +1,20 @@
-FROM node:24.18.0-alpine3.23 AS build
-
-# Tells pnpm to run non-interactively (needed for install/script steps)
-ENV CI=true
+FROM node:20.11-alpine3.18 as build

 # Move files into the image and install
 WORKDIR /app

 COPY ./bskyogcard/package.json ./
-COPY ./bskyogcard/pnpm-lock.yaml ./
-COPY ./bskyogcard/pnpm-workspace.yaml ./
-RUN npm install --global pnpm@11.13.1
-RUN pnpm install --frozen-lockfile
+COPY ./bskyogcard/yarn.lock ./
+RUN yarn install --frozen-lockfile

 COPY ./bskyogcard ./

 # build then prune dev deps
-RUN pnpm install-fonts && pnpm build
-RUN pnpm install --prod --ignore-scripts --prefer-offline
+RUN yarn install-fonts && yarn build
+RUN yarn install --production --ignore-scripts --prefer-offline

 # Uses assets from build stage to reduce build size
-FROM node:24.18.0-alpine3.23
+FROM node:20.11-alpine3.18

 RUN apk add --update dumb-init

@@ -31,10 +26,11 @@ COPY --from=build /app /app
 RUN mkdir /app/data && chown node /app/data

 VOLUME /app/data
-EXPOSE 3000 3001
+EXPOSE 3000
 ENV CARD_PORT=3000
-ENV CARD_METRICS_PORT=3001
 ENV NODE_ENV=production
+# potential perf issues w/ io_uring on this version of node
+ENV UV_USE_IO_URING=0

 # https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user
 USER node
@@ -1,24 +1,20 @@
-FROM golang:1.26-bookworm AS build-env
+FROM golang:1.23-bullseye AS build-env

 WORKDIR /usr/src/social-app

 ENV DEBIAN_FRONTEND=noninteractive

 # Node
-ENV NODE_VERSION=24.18.0
+ENV NODE_VERSION=20
 ENV NVM_DIR=/usr/share/nvm

 # Go
 ENV GODEBUG="netdns=go"
 ENV GOOS="linux"
-ARG TARGETARCH
-ENV GOARCH=${TARGETARCH:-amd64}
+ENV GOARCH="amd64"
 ENV CGO_ENABLED=1
 ENV GOEXPERIMENT="loopvar"

-# CI environment for pnpm
-ENV CI=true
-
 COPY . .

 #
@@ -33,11 +29,11 @@ RUN mkdir --parents $NVM_DIR && \
 RUN \. "$NVM_DIR/nvm.sh" && \
  nvm install $NODE_VERSION && \
  nvm use $NODE_VERSION && \
-  npm install --global pnpm@11.13.1 && \
-  pnpm install --frozen-lockfile && \
-  cd bskyembed && pnpm install --frozen-lockfile && cd .. && \
-  pnpm intl:build && \
-  pnpm build-embed
+  npm install --global yarn && \
+  yarn && \
+  cd bskyembed && yarn install --frozen-lockfile && cd .. && \
+  yarn intl:build && \
+  yarn build-embed

 # DEBUG
 RUN find ./bskyweb/embedr-static && find ./bskyweb/embedr-templates && find ./bskyembed/dist
@@ -62,7 +58,7 @@ RUN cd bskyweb/ && \
    -o /embedr \
    ./cmd/embedr

-FROM debian:bookworm-slim
+FROM debian:bullseye-slim

 ENV GODEBUG=netdns=go
 ENV TZ=Etc/UTC
@@ -1,4 +1,4 @@
-Copyright 2023–2026 Bluesky Social PBC
+Copyright 2023–2025 Bluesky PBC

 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

@@ -10,33 +10,33 @@ help: ## Print info about all commands

 .PHONY: build-web
 build-web: ## Compile web bundle, copy to bskyweb directory
-	pnpm intl:build
-	pnpm build-web
+	yarn intl:build
+	yarn build-web

 .PHONY: build-web-embed
 build-web-embed: ## Compile web embed bundle, copy to bskyweb/embedr* directories
-	pnpm intl:build
-	pnpm build-embed
+	yarn intl:build
+	yarn build-embed

 .PHONY: test
 test: ## Run all tests
-	NODE_ENV=test pnpm test
+	NODE_ENV=test yarn test

 .PHONY: lint
 lint: ## Run style checks and verify syntax
-	pnpm run lint
+	yarn run lint

 #.PHONY: fmt
 #fmt: ## Run syntax re-formatting
-#	pnpm prettier
+#	yarn prettier

 .PHONY: deps
-deps: ## Installs dependent libs using 'pnpm install'
-	pnpm install --frozen-lockfile
+deps: ## Installs dependent libs using 'yarn install'
+	yarn install --frozen-lockfile
 	cd bskyembed && yarn install --frozen-lockfile

 .PHONY: nvm-setup
-nvm-setup: ## Use NVM to install and activate node+pnpm
+nvm-setup: ## Use NVM to install and activate node+yarn
 	nvm install 20
 	nvm use 20
-	npm install --global pnpm
+	npm install --global yarn
@@ -10,7 +10,7 @@ Get the app itself:

 ## Development Resources

-This is a [React Native](https://reactnative.dev/) application, written in the TypeScript programming language. It builds on the `atproto` TypeScript packages (like [`@atproto/api`](https://www.npmjs.com/package/@atproto/api)), which are also open source, but in [a different git repository](https://github.com/bluesky-social/atproto).
+This is a [React Native](https://reactnative.dev/) application, written in the TypeScript programming language. It builds on the `atproto` TypeScript packages (like [`@atproto/api`](https://www.npmjs.com/package/@atproto/api)), code for which is also open source, but in [a different git repository](https://github.com/bluesky-social/atproto).

 There is a small amount of Go language source code (in `./bskyweb/`), for a web service that returns the React Native Web application.

@@ -19,7 +19,7 @@ The [Build Instructions](./docs/build.md) are a good place to get started with t
 The Authenticated Transfer Protocol ("AT Protocol" or "atproto") is a decentralized social media protocol. You don't *need* to understand AT Protocol to work with this application, but it can help. Learn more at:

 - [Overview and Guides](https://atproto.com/guides/overview)
- [GitHub Discussions](https://github.com/bluesky-social/atproto/discussions) 👈 Great place to ask questions
+- [Github Discussions](https://github.com/bluesky-social/atproto/discussions) 👈 Great place to ask questions
 - [Protocol Specifications](https://atproto.com/specs/atp)
 - [Blogpost on self-authenticating data structures](https://bsky.social/about/blog/3-6-2022-a-self-authenticating-social-protocol)

@@ -27,7 +27,6 @@ The Bluesky Social application encompasses a set of schemas and APIs built in th

 ## Contributions

-> [!NOTE]
 > While we do accept contributions, we prioritize high quality issues and pull requests. Adhering to the below guidelines will ensure a more timely review.

 **Rules:**
@@ -43,7 +42,7 @@ The Bluesky Social application encompasses a set of schemas and APIs built in th
 - Open an issue and give some time for discussion before submitting a PR.
 - Stay away from PRs like...
  - Changing "Post" to "Skeet."
-  - Refactoring the codebase, e.g., to replace React Query with Redux Toolkit or something.
+  - Refactoring the codebase, e.g., to replace MobX with Redux or something.
  - Adding entirely new features without prior discussion. 

 Remember, we serve a wide community of users. Our day-to-day involves us constantly asking "which top priority is our top priority." If you submit well-written PRs that solve problems concisely, that's an awesome contribution. Otherwise, as much as we'd love to accept your ideas and contributions, we really don't have the bandwidth. That's what forking is for!
@@ -60,7 +59,7 @@ Please be sure to:

 ## Security disclosures

-If you discover any security issues, please send an email to security@bsky.app. The email is automatically CC'd to the entire team and we'll respond promptly.
+If you discover any security issues, please send an email to security@bsky.app. The email is automatically CCed to the entire team and we'll respond promptly.

 ## Are you a developer interested in building on atproto?

@@ -70,8 +69,6 @@ Bluesky is an open social network built on the AT Protocol, a flexible technolog

 See [./LICENSE](./LICENSE) for the full license.

-Bluesky Social PBC has committed to a software patent non-aggression pledge. For details see [the original announcement](https://bsky.social/about/blog/10-01-2025-patent-pledge).
-
 ## P.S.

 We ❤️ you and all of the ways you support us. Thank you for making Bluesky a great place!
@@ -3,26 +3,21 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: ?users
+        SERVER_PATH: ?users
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"

 # Post an image with the porn label
 - assertVisible:
-    id: "composeFAB"
+      id: "composeFAB"
 - tapOn:
    id: "composeFAB"
 - inputText: "Post with an image"
 - tapOn:
-    id: "openMediaBtn"
- extendedWaitUntil:
-    visible:
-      id: "selectedPhotosView"
+    id: "openGalleryBtn"
+- tapOn: "Allow Full Access"
 - tapOn: "Content warnings"
 - tapOn: "Porn"
 - tapOn:
@@ -3,17 +3,13 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: ?users
+        SERVER_PATH: ?users
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
-
 - assertVisible:
-    id: "composeFAB"
+      id: "composeFAB"
 - tapOn:
    id: "composeFAB"
 - inputText: "Post text only"
@@ -25,10 +21,7 @@ appId: xyz.blueskyweb.app
    id: "composeFAB"
 - inputText: "Post with an image"
 - tapOn:
-    id: "openMediaBtn"
- extendedWaitUntil:
-    visible:
-      id: "selectedPhotosView"
+    id: "openGalleryBtn"
 - tapOn:
    id: "composerPublishBtn"
 - assertVisible:
@@ -44,12 +37,6 @@ appId: xyz.blueskyweb.app
    id: "e2eRefreshHome"
 - tapOn:
    id: "replyBtn"
-# Wait for the composer to fully open before typing. Tapping replyBtn right
-# after the previous publish can race the closing composer on Android.
- extendedWaitUntil:
-    visible:
-      id: "composerPublishBtn"
-    timeout: 10000
 - inputText: "Reply text only"
 - tapOn:
    id: "composerPublishBtn"
@@ -57,28 +44,15 @@ appId: xyz.blueskyweb.app
    id: "composeFAB"
 - tapOn:
    id: "replyBtn"
-# Wait for the composer to fully open before typing.
- extendedWaitUntil:
-    visible:
-      id: "composerPublishBtn"
-    timeout: 10000
 - inputText: "Reply with an image"
 - tapOn:
-    id: "openMediaBtn"
- extendedWaitUntil:
-    visible:
-      id: "selectedPhotosView"
+    id: "openGalleryBtn"
 - tapOn:
    id: "composerPublishBtn"
 - assertVisible:
    id: "composeFAB"
 - tapOn:
    id: "replyBtn"
-# Wait for the composer to fully open before typing.
- extendedWaitUntil:
-    visible:
-      id: "composerPublishBtn"
-    timeout: 10000
 - inputText: "Reply with a https://example.com link card"
 - tapOn:
    id: "composerPublishBtn"
@@ -99,10 +73,7 @@ appId: xyz.blueskyweb.app
    id: "quoteBtn"
 - inputText: "QP with an image"
 - tapOn:
-    id: "openMediaBtn"
- extendedWaitUntil:
-    visible:
-      id: "selectedPhotosView"
+    id: "openGalleryBtn"
 - tapOn:
    id: "composerPublishBtn"
 - assertVisible:
@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: ""
+        SERVER_PATH: ""
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
@@ -25,25 +25,10 @@ appId: xyz.blueskyweb.app
 - tapOn:
    id: "passwordInput"
 - inputText: "hunter22"
- tapOn:
-    # hideKeyboard on ios is borked
-    # https://docs.maestro.dev/troubleshooting/known-issues#hidekeyboard-command-is-flaky
-    text: "Your account"
+- hideKeyboard
 - tapOn:
    id: "nextBtn"
- waitForAnimationToEnd
- tapOn:
-    # save password thing no longer seems to be in hierarchy
-    # tap on something else instead
-    point: 20%,20%
-    repeat: 2
-    delay: 1000
- tapOn:
-    id: "handleInput"
 - inputText: "e2e-test"
- extendedWaitUntil:
-    visible:
-      id: "handleAvailableCheck"
 - tapOn:
    id: "nextBtn"
- assertVisible: "Give your profile a face"
+
@@ -3,96 +3,115 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users&follows&posts"
+        SERVER_PATH: "?users&follows&posts"
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"

 - tapOn:
    label: "Create a curate list"
    id: "e2eGotoLists"
 - tapOn:
    id: "newUserListBtn"
- waitForAnimationToEnd
- assertVisible: "Create user list"
+- assertVisible:
+    id: "createOrEditListModal"
 - tapOn:
-    id: "editListNameInput"
+    id: "editNameInput"
 - inputText: "Good Ppl"
 - tapOn:
-    id: "editListDescriptionInput"
+    id: "editDescriptionInput"
 - inputText: "They good"
 - tapOn: "Save"
- assertNotVisible: "Create user list"
+- tapOn: "Save"
+- assertNotVisible:
+    id: "createOrEditListModal"
 - tapOn: "People"
 - assertVisible: "Good Ppl"
 - assertVisible: "They good"

 - tapOn:
-    id: "moreOptionsBtn"
+    label: "Edit display name and description via the edit curatelist modal"
+    point: "90%,9%"
 - tapOn: "Edit list details"
- assertVisible: "Edit user list"
+- assertVisible:
+    id: "createOrEditListModal"
 - tapOn:
-    id: "editListNameInput"
+    id: "editNameInput"
 - eraseText
 - inputText: "Bad Ppl"
+- hideKeyboard
 - tapOn:
-    id: "editListDescriptionInput"
+    id: "editDescriptionInput"
 - eraseText
 - inputText: "They bad"
 - tapOn: "Save"
- assertNotVisible: "Edit user list"
+- tapOn: "Save"
+- assertNotVisible:
+    id: "createOrEditListModal"
 - assertVisible: Bad Ppl
 - assertVisible: They bad

 - tapOn:
-    id: "moreOptionsBtn"
+    label: "Remove description via the edit curatelist modal"
+    point: "90%,9%"
 - tapOn: "Edit list details"
- assertVisible: "Edit user list"
+- assertVisible:
+    id: "createOrEditListModal"
 - tapOn:
-    id: "editListDescriptionInput"
+    id: "editDescriptionInput"
 - eraseText
 - tapOn: "Save"
- assertNotVisible: "Edit user list"
+- tapOn: "Save"
+- assertNotVisible:
+    id: "createOrEditListModal"
 - assertNotVisible:
    id: "listDescription"

 - tapOn:
-    id: "moreOptionsBtn"
+    label: "Delete the curatelist"
+    point: "90%,9%"
 - tapOn: "Delete List"
 - tapOn:
    id: "confirmBtn"

+- tapOn:
+    label: "Create a new curatelist"
+    id: "e2eGotoLists"
+- tapOn:
+    id: "newUserListBtn"
 - assertVisible:
-    id: "newUserListBtn"
+    id: "createOrEditListModal"
 - tapOn:
-    id: "newUserListBtn"
- assertVisible: "Create user list"
- tapOn:
-    id: "editListNameInput"
+    id: "editNameInput"
 - inputText: "Good Ppl"
 - tapOn:
-    id: "editListDescriptionInput"
+    id: "editDescriptionInput"
 - inputText: "They good"
 - tapOn: "Save"
- assertNotVisible: "Create user list"
+- tapOn: "Save"
+- assertNotVisible:
+    id: "createOrEditListModal"
 - tapOn: "People"
 - assertVisible: "Good Ppl"
 - assertVisible: "They good"
 - tapOn: "People"

 - tapOn: "Start adding people"
- tapOn: "Search"
+- assertVisible:
+    id: "listAddUserModal"
+- tapOn:
+    id: "searchInput"
 - inputText: "b"
 - pressKey: Enter
- tapOn: "Add user to list"
- swipe:
-    direction: DOWN
+- tapOn:
+    id: "user-bob.test-addBtn"
+- tapOn:
+    id: "doneBtn"
+- assertNotVisible:
+    id: "listAddUserModal"
 - assertVisible:
-    id: "profileCard-bob.test-link"
+    id: "user-bob.test"

 - tapOn: "Posts"
 - assertVisible:
@@ -125,18 +144,23 @@ appId: xyz.blueskyweb.app

 - tapOn: "People"
 - assertVisible:
-    id: "profileCard-bob.test-link"
+    label: "Removes users on curatelists from the list"
+    id: "user-bob.test"
 - tapOn:
    point: "90%,43%"
+- assertVisible:
+    id: "userAddRemoveListsModal"
 - tapOn:
    id: "user-bob.test-addBtn"
 - tapOn:
    id: "doneBtn"
+- assertNotVisible:
+    id: "userAddRemoveListsModal"

 - tapOn:
+    label: "Adds and removes users on curatelists from the profile"
    id: "bottomBarSearchBtn"
- tapOn:
-    id: "searchScreenInput"
+- tapOn: "Search for posts, users, or feeds"
 - inputText: "bob"
 - tapOn:
    id: "searchAutoCompleteResult-bob.test"
@@ -146,21 +170,21 @@ appId: xyz.blueskyweb.app
    id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsDialog"
+    id: "userAddRemoveListsModal"
 - tapOn:
    id: "user-bob.test-addBtn"
 - tapOn:
    id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsDialog"
+    id: "userAddRemoveListsModal"
 - tapOn:
    id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsDialog"
+    id: "userAddRemoveListsModal"
 - tapOn:
    id: "user-bob.test-addBtn"
 - tapOn:
    id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsDialog"
+    id: "userAddRemoveListsModal"
@@ -29,88 +29,45 @@ appId: xyz.blueskyweb.app
    id: "homeScreenFeedTabs-selector-1"
    text: "alice-favs"

-# Reordering feeds is driven by a drag on the feed-drag-handle. Maestro cannot
-# activate the RNGH Pan gesture from a synthetic swipe on Android (proven
-# twice - coordinate swipes never register the pan), so the reorder
-# verification below runs on iOS only. If Android drag coverage is needed,
-# revisit with the SavedFeedsA11y move buttons rather than a swipe.
- runFlow:
-    when:
-      platform: iOS
-    commands:
-      # Set alice-favs first
-      - tapOn: "Open drawer menu"
-      - tapOn:
-          id: "menuItemButton-Feeds"
-      - tapOn:
-          id: "editFeedsBtn"
-      - swipe:
-          label: "Drag feed down"
-          from:
-            id: "feed-drag-handle"
-          direction: "DOWN"
-          duration: 1000
-      - assertVisible:
-          id: "saveChangesBtn"
-          enabled: true
-      - tapOn:
-            label: "Save button"
-            id: "saveChangesBtn"
-      - tapOn: "Go back"
-      - assertVisible:
-          id: "homeScreenFeedTabs-selector-0"
-          text: "alice-favs"
-      - assertVisible:
-          id: "homeScreenFeedTabs-selector-1"
-          text: "Following"
+# Set alice-favs first
+- tapOn: "Open drawer menu"
+- tapOn:
+    id: "menuItemButton-Feeds"
+- tapOn:
+    id: "editFeedsBtn"
+- tapOn:
+    label: "Tap on down arrow"
+    id: "feed-timeline-moveDown"
+- tapOn:
+      label: "Save button"
+      id: "saveChangesBtn"
+- tapOn: "Go back"
+- assertVisible:
+    id: "homeScreenFeedTabs-selector-0"
+    text: "alice-favs"
+- assertVisible:
+    id: "homeScreenFeedTabs-selector-1"
+    text: "Following"

-      # Set following first
-      - tapOn: "Open drawer menu"
-      - tapOn:
-          id: "menuItemButton-Feeds"
-      - tapOn:
-          id: "editFeedsBtn"
-      - swipe:
-          label: "Drag feed down"
-          from:
-            id: "feed-drag-handle"
-          direction: "DOWN"
-          duration: 1000
-      - assertVisible:
-          id: "saveChangesBtn"
-          enabled: true
-      - tapOn:
-          label: "Save button"
-          id: "saveChangesBtn"
-      - tapOn: "Go back"
-      - assertVisible:
-          id: "homeScreenFeedTabs-selector-0"
-          text: "Following"
-      - assertVisible:
-          id: "homeScreenFeedTabs-selector-1"
-          text: "alice-favs"
-
-# On Android, the reorder path above is skipped. Smoke-test that the feeds
-# edit screen opens and the pinned feeds render, then return to a valid state.
- runFlow:
-    when:
-      platform: Android
-    commands:
-      - tapOn: "Open drawer menu"
-      - tapOn:
-          id: "menuItemButton-Feeds"
-      - tapOn:
-          id: "editFeedsBtn"
-      - assertVisible: "Following"
-      - assertVisible: "alice-favs"
-      # Two back presses to reach Home: the first pops the saved-feeds editor
-      # back to the Feeds screen, the second pops Feeds back to Home. On iOS the
-      # equivalent path saves changes first (saveChangesBtn calls
-      # navigation.goBack), so a single "Go back" there already lands on Home.
-      # This Android smoke branch never saves, so it needs the extra pop to
-      # leave the screen state on Home, which the shared steps below expect.
-      - tapOn: "Go back"
-      - tapOn: "Go back"
+# Set following first
+- tapOn: "Open drawer menu"
+- tapOn:
+    id: "menuItemButton-Feeds"
+- tapOn:
+    id: "editFeedsBtn"
+- tapOn:
+    label: "Tap on down arrow"
+    id: "feed-feed-moveDown"
+- tapOn:
+    label: "Save button"
+    id: "saveChangesBtn"
+- tapOn: "Go back"
+- assertVisible:
+    id: "homeScreenFeedTabs-selector-0"
+    text: "Following"
+- assertVisible:
+    id: "homeScreenFeedTabs-selector-1"
+    text: "alice-favs"

 # Remove following
 - tapOn: "Open drawer menu"
@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: ?users&follows&posts&feeds
+        SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
@@ -11,7 +11,7 @@ appId: xyz.blueskyweb.app

 - extendedWaitUntil:
    visible:
-      text: "Feeds ✨"
+        text: "Feeds ✨"
 - tapOn:
    label: "Can go to feeds page using feeds button in tab bar"
    text: "Feeds ✨"
@@ -50,6 +50,6 @@ appId: xyz.blueskyweb.app
    label: "Can delete posts"
    id: "postDropdownBtn"
    childOf:
-      id: "feedItem-by-alice.test"
+        id: "feedItem-by-alice.test"
 - tapOn: "Delete post"
 - tapOn: "Delete"
@@ -11,18 +11,11 @@ appId: xyz.blueskyweb.app
 - tapOn: "Sign in"
 - tapOn:
    id: "selectServiceButton"
- tapOn:
-    id: "manualSelectBtn"
+- tapOn: "Custom"
 - tapOn:
    id: "customServerTextInput"
 - inputText: "http://localhost:3000"
- runFlow:
-    when:
-      platform: Android
-    commands:
-      - hideKeyboard
- tapOn:
-    id: "doneBtn"
+- tapOn: "Done"
 - tapOn:
    id: "loginUsernameInput"
 - inputText: "Alice"
@@ -30,7 +23,4 @@ appId: xyz.blueskyweb.app
    id: "loginPasswordInput"
 - inputText: "hunter2"
 - pressKey: Enter
- tapOn:
-    text: "Not Now"
-    optional: true
 - assertVisible: "Following"
@@ -3,14 +3,11 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users&follows&labels"
+        SERVER_PATH: "?users&follows&labels"
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"

 # create a modlist
 - tapOn:
@@ -19,25 +16,32 @@ appId: xyz.blueskyweb.app
    id: "moderationlistsBtn"
 - tapOn: "New list"
 - tapOn:
-    id: "editListNameInput"
+    id: "editNameInput"
 - inputText: "Muted Users"
 - tapOn:
-    id: "editListDescriptionInput"
+    id: "editDescriptionInput"
 - inputText: "Shhh"
 - tapOn: "Save"
+- tapOn: "Save"

 # view modlist
 - assertVisible: "Muted Users"
 - assertVisible: "Shhh"

- tapOn: "Subscribe to this list"
+- tapOn:
+    label: "Dropdown"
+    point: "71%,9%"
+
 - tapOn: "Mute accounts"
 - tapOn: "Mute list"
 - tapOn: "Unmute"

- tapOn: "Subscribe to this list"
+- tapOn:
+      label: "Dropdown"
+      point: "71%,9%"
+
 - tapOn: "Block accounts"
 - tapOn: "Block list"
 - tapOn: "Unblock"

-  # the rest of the behaviors are tested in curate-lists.yml
+ # the rest of the behaviors are tested in curate-lists.yml
@@ -3,36 +3,14 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users"
+        SERVER_PATH: "?users"
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
-
 - tapOn:
    id: "e2eStartOnboarding"
 - tapOn: "Open avatar creator"
-# The avatar-creator bottom sheet (Dialog.Inner, non-scrollable) opens only
-# half-expanded on the short E2E emulator (720x1600), a ~220px sliver with the
-# emoji grid below the fold. It is NOT a scroll view, so scrollUntilVisible's
-# swipe grabs the sheet's own drag gesture and flings it closed. Instead, drag
-# the sheet upward to expand it to full height, which brings the picker into
-# view. iOS opens the sheet fully already, so this is Android-only.
- runFlow:
-    when:
-      platform: Android
-    commands:
-      - swipe:
-          label: "Drag the bottom sheet up to expand it"
-          start: "50%, 90%"
-          end: "50%, 20%"
-          duration: 600
-      - extendedWaitUntil:
-          visible: "Select an emoji"
-          timeout: 10000
 - tapOn: "Select the zap emoji as your avatar"
 - tapOn:
    label: "Tap on yellow"
@@ -40,41 +18,15 @@ appId: xyz.blueskyweb.app
 - tapOn: "Done"
 - waitForAnimationToEnd
 - tapOn: "Select an avatar"
-# Reopening the creator sheet lands on the same half-expanded sliver on
-# Android, so expand it again before reaching for the emoji grid. No-op on iOS.
- runFlow:
-    when:
-      platform: Android
-    commands:
-      - swipe:
-          label: "Drag the bottom sheet up to expand it"
-          start: "50%, 90%"
-          end: "50%, 20%"
-          duration: 600
-      - extendedWaitUntil:
-          visible: "Select an emoji"
-          timeout: 10000
 - tapOn: "Select the atom emoji as your avatar"
 - tapOn: "Done"
 - waitForAnimationToEnd
- tapOn:
-    id: "onboardingContinue"
+- tapOn: "Continue to next step"
 - assertVisible: "What are your interests?"
 - tapOn:
-    id: "onboardingContinue"
- assertVisible: "Suggested for you"
-# mock server doesn't have suggestions api
- tapOn: "Skip to next step"
- swipe:
-    direction: "LEFT"
- swipe:
-    direction: "LEFT"
- assertVisible: "Complete onboarding and start using your account"
+    label: "Tap on continue"
+    point: "50%,92%"
+- assertVisible: "You're ready to go!"
 - tapOn:
-    id: "onboardingFinish"
- tapOn:
-    label: "NUX, if applicable"
-    text: "Close"
-    optional: true
- waitForAnimationToEnd
- assertVisible: "Following"
+    label: "Tap on Lets go"
+    point: "50%,92%"
@@ -3,59 +3,26 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users"
+        SERVER_PATH: "?users"
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
-
 - tapOn:
    id: "e2eStartOnboarding"
 - tapOn: "Select an avatar"
 - waitForAnimationToEnd
- runFlow:
-    when:
-      platform: iOS
-    commands:
-      - assertVisible: "Photos"
-      - assertVisible: "Collections"
-      - tapOn:
-          point: "50%,22%"
-      - waitForAnimationToEnd
-      - tapOn: "Done"
-      - waitForAnimationToEnd
- runFlow:
-    when:
-      platform: Android
-    commands:
-      # The system photo picker opened here shows MediaStore photos, which
-      # the e2e run doesn't seed (media is seeded into app-scoped storage for
-      # the composer's mocked picker instead). With no photo to pick, dismiss
-      # the picker and continue - onContinue falls back to the generated
-      # placeholder avatar, and nothing later in the flow depends on the image.
-      - back
-      - waitForAnimationToEnd
 - tapOn:
-    id: "onboardingContinue"
+    point: "50%,22%"
+- waitForAnimationToEnd
+- tapOn: "Choose"
+- waitForAnimationToEnd
+- tapOn: "Continue to next step"
 - assertVisible: "What are your interests?"
 - tapOn:
-    id: "onboardingContinue"
- assertVisible: "Suggested for you"
-# mock server doesn't have suggestions api
- tapOn: "Skip to next step"
- swipe:
-    direction: "LEFT"
- swipe:
-    direction: "LEFT"
- assertVisible: "Complete onboarding and start using your account"
+    label: "Tap on continue"
+    point: "50%,92%"
+- assertVisible: "You're ready to go!"
 - tapOn:
-    id: "onboardingFinish"
- tapOn:
-    label: "NUX, if applicable"
-    text: "Close"
-    optional: true
- waitForAnimationToEnd
- assertVisible: "Following"
+    label: "Tap on Lets go"
+    point: "50%,92%"
@@ -3,22 +3,18 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users&follows&posts"
+        SERVER_PATH: "?users&follows&posts"
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"

 - tapOn:
    id: "postDropdownBtn"
    index: 0
 - tapOn:
    id: "postDropdownReportBtn"
- tapOn: "Create report for Misleading"
- tapOn: "Create report for Spam"
+- tapOn: "Create report for Misleading Post"
 - tapOn: "Send report to Dev-env Moderation"
 - tapOn:
    point: "50%,90%"
@@ -45,7 +45,7 @@ appId: xyz.blueskyweb.app
    id: "editProfileSaveBtn"
 - assertNotVisible:
    id: "editProfileModal"
- assertVisible: ".*Alicia.*"
+- assertVisible: "Alicia"
 - assertVisible: "One cool hacker"

 # Remove display name and description via the edit profile modal
@@ -64,10 +64,7 @@ appId: xyz.blueskyweb.app
    id: "editProfileSaveBtn"
 - assertNotVisible:
    id: "editProfileModal"
-# The display-name node renders the handle as a Text with a nested badge View
-# once the display name is cleared, so the a11y text is not the bare handle
-# string on Android. Match it as a substring instead.
- assertVisible: ".*alice\\.test.*"
+- assertVisible: "alice.test"
 - assertNotVisible: "One cool hacker"

 # Set avi and banner via the edit profile modal
@@ -81,13 +78,13 @@ appId: xyz.blueskyweb.app
    id: "changeBannerBtn"
 - tapOn: "Upload from Library"
 - waitForAnimationToEnd
- tapOn: "Done"
+- tapOn: "Choose"
 - waitForAnimationToEnd
 - tapOn:
    id: "changeAvatarBtn"
 - tapOn: "Upload from Library"
 - waitForAnimationToEnd
- tapOn: "Done"
+- tapOn: "Choose"
 - waitForAnimationToEnd
 - tapOn:
    id: "editProfileSaveBtn"
@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users&posts&feeds"
+        SERVER_PATH: "?users&posts&feeds"
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
@@ -12,11 +12,10 @@ appId: xyz.blueskyweb.app
 # Navigate to another user profile
 - extendedWaitUntil:
    visible:
-      id: "bottomBarSearchBtn"
+        id: "bottomBarSearchBtn"
 - tapOn:
    id: "bottomBarSearchBtn"
- tapOn:
-    id: "searchScreenInput"
+- tapOn: "Search for posts, users, or feeds"
 - inputText: "b"
 - tapOn:
    id: "searchAutoCompleteResult-bob.test"
@@ -26,8 +25,6 @@ appId: xyz.blueskyweb.app
 # Can follow/unfollow another user
 - tapOn:
    id: "followBtn"
- tapOn:
-    point: 65%,35% # dismiss the subscribe prompt
 - tapOn:
    id: "unfollowBtn"

@@ -39,4 +36,4 @@ appId: xyz.blueskyweb.app
 - tapOn:
    id: "profileHeaderDropdownBtn"
 - tapOn: "Unmute Account"
- assertNotVisible: "Account Muted"
+- assertNotVisible: "Account Muted"
@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../../setupServer.js
    env:
-      SERVER_PATH: ?users&follows&posts&feeds
+        SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
    file: ../../setupApp.yml
 - tapOn:
@@ -15,14 +15,10 @@ appId: xyz.blueskyweb.app
 - tapOn:
    id: "profileHeaderDropdownReportBtn"
 - tapOn:
-    id: "report:category:Misleading"
- tapOn:
-    id: "report:option:Spam"
+    id: "report:option:com.atproto.moderation.defs#reasonSpam"
 - assertVisible:
-    text: "Send report to Dev-env Moderation"
+    id: "report:labeler:mod-authority.test"
 - tapOn:
    id: "report:submit"
- extendedWaitUntil:
-    notVisible:
-      id: "report:dialog"
-    timeout: 20000
+- assertNotVisible:
+    id: "report:dialog"
@@ -1,45 +0,0 @@
-appId: xyz.blueskyweb.app
---
- runScript:
-    file: ../../setupServer.js
-    env:
-      SERVER_PATH: ?users&follows&posts&feeds
- runFlow:
-    file: ../../setupApp.yml
- tapOn:
-    id: "e2eSignInAlice"
-
- tapOn:
-    id: "postDropdownBtn"
-    index: 0
- tapOn:
-    id: "postDropdownReportBtn"
- tapOn:
-    id: "report:category:Misleading"
- tapOn:
-    id: "report:option:Other misleading content"
- assertVisible:
-    text: Your report will be sent to Dev-env Moderation.*
-# reason "other" defaults with details open
- assertVisible:
-    id: "report:details"
- tapOn:
-    id: "report:clearReportOption"
- assertNotVisible:
-    id: "report:details"
- tapOn:
-    id: "report:clearCategory"
- assertNotVisible:
-    id: "report:option:Other misleading content"
- tapOn:
-    id: "report:category:Misleading"
- tapOn:
-    id: "report:option:Spam"
- assertVisible:
-    text: Your report will be sent to Dev-env Moderation.*
- tapOn:
-    id: "report:submit"
- extendedWaitUntil:
-    notVisible:
-      id: "report:dialog"
-    timeout: 20000
@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../../setupServer.js
    env:
-      SERVER_PATH: ?users&follows&posts&feeds
+        SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
    file: ../../setupApp.yml
 - tapOn:
@@ -15,14 +15,10 @@ appId: xyz.blueskyweb.app
 - tapOn:
    id: "postDropdownReportBtn"
 - tapOn:
-    id: "report:category:Misleading"
- tapOn:
-    id: "report:option:Spam"
+    id: "report:option:com.atproto.moderation.defs#reasonSpam"
 - assertVisible:
-    text: "Send report to Dev-env Moderation"
+    id: "report:labeler:mod-authority.test"
 - tapOn:
    id: "report:submit"
- extendedWaitUntil:
-    notVisible:
-      id: "report:dialog"
-    timeout: 20000
+- assertNotVisible:
+    id: "report:dialog"
@@ -0,0 +1,35 @@
+appId: xyz.blueskyweb.app
+---
+- runScript:
+    file: ../../setupServer.js
+    env:
+        SERVER_PATH: ?users&follows&posts&feeds
+- runFlow:
+    file: ../../setupApp.yml
+- tapOn:
+    id: "e2eSignInAlice"
+
+- tapOn:
+    id: "postDropdownBtn"
+    index: 0
+- tapOn:
+    id: "postDropdownReportBtn"
+- tapOn:
+    id: "report:option:com.atproto.moderation.defs#reasonOther"
+- assertVisible:
+    id: "report:labeler:mod-authority.test"
+# reason "other" defaults with details open
+- assertVisible:
+    id: "report:details"
+- tapOn:
+    id: "report:clearOption"
+- assertNotVisible:
+    id: "report:details"
+- tapOn:
+    id: "report:option:com.atproto.moderation.defs#reasonSpam"
+- assertVisible:
+    id: "report:labeler:mod-authority.test"
+- tapOn:
+    id: "report:submit"
+- assertNotVisible:
+    id: "report:dialog"
@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../../setupServer.js
    env:
-      SERVER_PATH: ?users&follows&posts&feeds
+        SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
    file: ../../setupApp.yml
 - tapOn:
@@ -15,21 +15,16 @@ appId: xyz.blueskyweb.app
 - tapOn:
    id: "postDropdownReportBtn"
 - tapOn:
-    id: "report:category:Misleading"
- tapOn:
-    id: "report:option:Other misleading content"
+    id: "report:option:com.atproto.moderation.defs#reasonOther"
 - assertVisible:
-    text: "Send report to Dev-env Moderation"
+    id: "report:labeler:mod-authority.test"
 # reason "other" defaults with details open
 - assertVisible:
    id: "report:details"
 - tapOn:
    id: "report:details"
 - inputText: "This is a test report"
- hideKeyboard
 - tapOn:
    id: "report:submit"
- extendedWaitUntil:
-    notVisible:
-      id: "report:dialog"
-    timeout: 20000
+- assertNotVisible:
+    id: "report:dialog"
@@ -3,24 +3,20 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users"
+        SERVER_PATH: "?users"
 - runFlow:
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"

 # Navigate to another user profile via autocomplete
- extendedWaitUntil:
-    visible:
-      id: "bottomBarSearchBtn"
 - tapOn:
    id: "bottomBarSearchBtn"
- assertVisible:
-    id: "searchScreenInput"
- tapOn:
-    id: "searchScreenInput"
+- assertVisible: "Search for posts, users, or feeds"
+- tapOn: "Search for posts, users, or feeds"
 - inputText: "b"
 - tapOn:
    id: "searchAutoCompleteResult-bob.test"
 - assertVisible:
    id: "profileView"
+
@@ -8,12 +8,8 @@ appId: xyz.blueskyweb.app
    file: ../setupApp.yml
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
-
 - assertVisible:
-    id: "storybookBtn"
+      id: "storybookBtn"
 - tapOn:
    id: "storybookBtn"
 - tapOn:
@@ -3,16 +3,13 @@ appId: xyz.blueskyweb.app
 - runScript:
    file: ../setupServer.js
    env:
-      SERVER_PATH: "?users&follows"
+        SERVER_PATH: "?users&follows"
 - runFlow:
    file: ../setupApp.yml

 # Login, create a thread, and log out
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
 - assertVisible:
    id: "composeFAB"
 - tapOn:
@@ -20,166 +17,67 @@ appId: xyz.blueskyweb.app
 - inputText: "Test thread"
 - tapOn:
    id: "composerPublishBtn"
-# Wait for the composer to close and the home feed to settle before signing
-# out. Without a settle guard the next action can race the closing composer.
- extendedWaitUntil:
-    visible:
-      id: "composeFAB"
-    timeout: 10000

 # Login, reply to the thread, and log out
- tapOn:
-    id: "e2eSignOut"
 - tapOn:
    id: "e2eSignInBob"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
    id: "replyBtn"
-# Wait for the composer to fully open before typing.
- extendedWaitUntil:
-    visible:
-      id: "composerPublishBtn"
-    timeout: 10000
 - inputText: "Reply 1"
 - tapOn:
    id: "composerPublishBtn"
-# Wait for the composer to close before signing out.
- extendedWaitUntil:
-    visible:
-      id: "composeFAB"
-    timeout: 10000

 # Login, confirm notification exists, mute thread, and log out
- tapOn:
-    id: "e2eSignOut"
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
    id: "bottomBarNotificationsBtn"
- assertVisible: ".*Reply 1.*"
- tapOn: ".*Reply 1.*"
+- assertVisible:
+    id: "feedItem-by-bob.test"
+- tapOn:
+    id: "feedItem-by-bob.test"
 - tapOn:
    id: "postDropdownBtn"
    childOf:
-      id: "postThreadItem-by-bob.test"
+        id: "postThreadItem-by-bob.test"
 - tapOn: "Mute thread"

 # Login, reply to the thread twice, and log out
- tapOn:
-    id: "e2eSignOut"
 - tapOn:
    id: "e2eSignInBob"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
    id: "bottomBarProfileBtn"
 - tapOn:
    id: "profilePager-selector-1"
-# Both replies target the thread root ("Test thread" by alice), which sits at
-# the top of bob's Replies tab. That tab renders each post in the thread with
-# its own replyBtn, so scope the tap to the root post's card
-# (feedItem-by-alice.test) rather than relying on which replyBtn Maestro picks
-# first. This keeps both reply taps deterministic regardless of list order or
-# how many posts have rendered.
-#
-# Even with the close-gating below, the replyBtn tap can land on a recycled list
-# row while the author feed re-renders after a publish, and be swallowed so the
-# composer never opens. Wrapping the tap + open-wait in retry makes opening the
-# composer idempotent: a swallowed tap just re-taps until the publish button
-# appears. A first-try success does not retry.
- retry:
-    maxRetries: 3
-    commands:
-      - tapOn:
-          id: "replyBtn"
-          childOf:
-            id: "feedItem-by-alice.test"
-      # Wait for the composer to fully open before typing.
-      - extendedWaitUntil:
-          visible:
-            id: "composerPublishBtn"
-          timeout: 10000
+- tapOn:
+    id: "replyBtn"
 - inputText: "Reply 2"
 - tapOn:
    id: "composerPublishBtn"
-# Wait for the composer to actually close before opening it again. replyBtn
-# stays in the accessibility tree behind the open composer sheet, so waiting on
-# its visibility returns immediately and does not gate on the close animation or
-# the author-feed re-render that follows a post - the next replyBtn tap then
-# fires mid-transition and is swallowed, so the composer never opens. Gate on
-# the publish button disappearing (the composer is gone), then confirm the
-# reply button underneath is back and let animations settle.
- extendedWaitUntil:
-    notVisible:
-      id: "composerPublishBtn"
-    timeout: 15000
- extendedWaitUntil:
-    visible:
-      id: "replyBtn"
-    timeout: 10000
- waitForAnimationToEnd
-# As with Reply 2: even after gating on the composer close, this tap can hit a
-# recycled row during the post-publish feed re-render and be swallowed, so wrap
-# the open in retry to make it idempotent.
- retry:
-    maxRetries: 3
-    commands:
-      - tapOn:
-          id: "replyBtn"
-          childOf:
-            id: "feedItem-by-alice.test"
-      # Wait for the composer to fully open before typing.
-      - extendedWaitUntil:
-          visible:
-            id: "composerPublishBtn"
-          timeout: 10000
+- tapOn:
+    id: "replyBtn"
 - inputText: "Reply 3"
 - tapOn:
    id: "composerPublishBtn"
-# Wait for the composer to actually close before signing out. As above,
-# replyBtn stays visible behind the sheet, so gate on the publish button
-# disappearing first, then confirm the reply button underneath has returned.
- extendedWaitUntil:
-    notVisible:
-      id: "composerPublishBtn"
-    timeout: 15000
- extendedWaitUntil:
-    visible:
-      id: "replyBtn"
-    timeout: 10000

-# Login, confirm notifications dont exist, unmute the thread, ~~confirm notifications exist~~
-# Mute thread behaviour no longer change old notifications after muting/unmuting a thread -sfn
- tapOn:
-    id: "e2eSignOut"
+
+# Login, confirm notifications dont exist, unmute the thread, confirm notifications exist
 - tapOn:
    id: "e2eSignInAlice"
- extendedWaitUntil:
-    visible:
-      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
    id: "bottomBarNotificationsBtn"
- assertVisible: ".*Reply 1.*"
- assertNotVisible: ".*Reply 2.*"
- assertNotVisible: ".*Reply 3.*"
- tapOn: ".*Reply 1.*"
+- assertNotVisible:
+    id: "feedItem-by-bob.test"
+- tapOn:
+    id: "bottomBarHomeBtn"
 - tapOn:
    id: "postDropdownBtn"
-    childOf:
-      id: "postThreadItem-by-bob.test"
 - tapOn: "Unmute thread"
 - tapOn:
    id: "bottomBarNotificationsBtn"
 - swipe:
    from:
-      id: "notifsFeed"
+        id: "notifsFeed"
    direction: DOWN
- assertVisible: ".*Reply 1.*"
- assertNotVisible: ".*Reply 2.*"
- assertNotVisible: ".*Reply 3.*"
+- assertVisible:
+    id: "feedItem-by-bob.test"
@@ -0,0 +1,520 @@
+import {createServer as createHTTPServer} from 'node:http'
+import {parse} from 'node:url'
+
+import {createServer, TestPDS} from '../jest/test-pds'
+
+async function main() {
+  let server: TestPDS
+  createHTTPServer(async (req, res) => {
+    const url = parse(req.url || '/', true)
+    if (req.method !== 'POST') {
+      return res.writeHead(200).end()
+    }
+    try {
+      console.log('Closing old server')
+      await server?.close()
+      console.log('Starting new server')
+      const inviteRequired = url?.query && 'invite' in url.query
+      server = await createServer({inviteRequired})
+      console.log('Listening at', server.pdsUrl)
+      if (url?.query) {
+        if ('users' in url.query) {
+          console.log('Generating mock users')
+          await server.mocker.createUser('alice')
+          await server.mocker.createUser('bob')
+          await server.mocker.createUser('carla')
+          await server.mocker.users.alice.agent.upsertProfile(() => ({
+            displayName: 'Alice',
+            description: 'Test user 1',
+          }))
+          await server.mocker.users.bob.agent.upsertProfile(() => ({
+            displayName: 'Bob',
+            description: 'Test user 2',
+          }))
+          await server.mocker.users.carla.agent.upsertProfile(() => ({
+            displayName: 'Carla',
+            description: 'Test user 3',
+          }))
+          if (inviteRequired) {
+            await server.mocker.createInvite(server.mocker.users.alice.did)
+          }
+        }
+        if ('follows' in url.query) {
+          console.log('Generating mock follows')
+          await server.mocker.follow('alice', 'bob')
+          await server.mocker.follow('alice', 'carla')
+          await server.mocker.follow('bob', 'alice')
+          await server.mocker.follow('bob', 'carla')
+          await server.mocker.follow('carla', 'alice')
+          await server.mocker.follow('carla', 'bob')
+        }
+        if ('posts' in url.query) {
+          console.log('Generating mock posts')
+          for (let user in server.mocker.users) {
+            await server.mocker.users[user].agent.post({text: 'Post'})
+          }
+        }
+        if ('feeds' in url.query) {
+          console.log('Generating mock feed')
+          await server.mocker.createFeed('alice', 'alice-favs', [])
+        }
+        if ('thread' in url.query) {
+          console.log('Generating mock posts')
+          const res = await server.mocker.users.bob.agent.post({
+            text: 'Thread root',
+          })
+          await server.mocker.users.carla.agent.post({
+            text: 'Thread reply',
+            reply: {
+              parent: {cid: res.cid, uri: res.uri},
+              root: {cid: res.cid, uri: res.uri},
+            },
+          })
+        }
+        if ('mergefeed' in url.query) {
+          console.log('Generating mock users')
+          await server.mocker.createUser('alice')
+          await server.mocker.createUser('bob')
+          await server.mocker.createUser('carla')
+          await server.mocker.createUser('dan')
+          await server.mocker.users.alice.agent.upsertProfile(() => ({
+            displayName: 'Alice',
+            description: 'Test user 1',
+          }))
+          await server.mocker.users.bob.agent.upsertProfile(() => ({
+            displayName: 'Bob',
+            description: 'Test user 2',
+          }))
+          await server.mocker.users.carla.agent.upsertProfile(() => ({
+            displayName: 'Carla',
+            description: 'Test user 3',
+          }))
+          await server.mocker.users.dan.agent.upsertProfile(() => ({
+            displayName: 'Dan',
+            description: 'Test user 4',
+          }))
+          console.log('Generating mock follows')
+          await server.mocker.follow('alice', 'bob')
+          await server.mocker.follow('alice', 'carla')
+          console.log('Generating mock posts')
+          let posts: Record<string, any[]> = {
+            alice: [],
+            bob: [],
+            carla: [],
+            dan: [],
+          }
+          for (let i = 0; i < 10; i++) {
+            for (let user in server.mocker.users) {
+              if (user === 'alice') continue
+              posts[user].push(
+                await server.mocker.createPost(user, `Post ${i}`),
+              )
+            }
+          }
+          for (let i = 0; i < 10; i++) {
+            for (let user in server.mocker.users) {
+              if (user === 'alice') continue
+              if (i % 5 === 0) {
+                await server.mocker.createReply(user, 'Self reply', {
+                  cid: posts[user][i].cid,
+                  uri: posts[user][i].uri,
+                })
+              }
+              if (i % 5 === 1) {
+                await server.mocker.createReply(user, 'Reply to bob', {
+                  cid: posts.bob[i].cid,
+                  uri: posts.bob[i].uri,
+                })
+              }
+              if (i % 5 === 2) {
+                await server.mocker.createReply(user, 'Reply to dan', {
+                  cid: posts.dan[i].cid,
+                  uri: posts.dan[i].uri,
+                })
+              }
+              await server.mocker.users[user].agent.post({text: `Post ${i}`})
+            }
+          }
+          console.log('Generating mock feeds')
+          await server.mocker.createFeed(
+            'alice',
+            'alice-favs',
+            posts.dan.map(p => p.uri),
+          )
+          await server.mocker.createFeed(
+            'alice',
+            'alice-favs2',
+            posts.dan.map(p => p.uri),
+          )
+        }
+        if ('labels' in url.query) {
+          console.log('Generating naughty users with labels')
+
+          const anchorPost = await server.mocker.createPost(
+            'alice',
+            'Anchor post',
+          )
+
+          for (const user of [
+            'dmca-account',
+            'dmca-profile',
+            'dmca-posts',
+            'porn-account',
+            'porn-profile',
+            'porn-posts',
+            'nudity-account',
+            'nudity-profile',
+            'nudity-posts',
+            'scam-account',
+            'scam-profile',
+            'scam-posts',
+            'unknown-account',
+            'unknown-profile',
+            'unknown-posts',
+            'hide-account',
+            'hide-profile',
+            'hide-posts',
+            'no-promote-account',
+            'no-promote-profile',
+            'no-promote-posts',
+            'warn-account',
+            'warn-profile',
+            'warn-posts',
+            'muted-account',
+            'muted-by-list-account',
+            'blocking-account',
+            'blockedby-account',
+            'mutual-block-account',
+          ]) {
+            await server.mocker.createUser(user)
+            await server.mocker.follow('alice', user)
+            await server.mocker.follow(user, 'alice')
+            await server.mocker.createPost(user, `Unlabeled post from ${user}`)
+            await server.mocker.createReply(
+              user,
+              `Unlabeled reply from ${user}`,
+              anchorPost,
+            )
+            await server.mocker.like(user, anchorPost)
+          }
+
+          await server.mocker.labelAccount('dmca-violation', 'dmca-account')
+          await server.mocker.labelProfile('dmca-violation', 'dmca-profile')
+          await server.mocker.labelPost(
+            'dmca-violation',
+            await server.mocker.createPost('dmca-posts', 'dmca post'),
+          )
+          await server.mocker.labelPost(
+            'dmca-violation',
+            await server.mocker.createQuotePost(
+              'dmca-posts',
+              'dmca quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            'dmca-violation',
+            await server.mocker.createReply(
+              'dmca-posts',
+              'dmca reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.labelAccount('porn', 'porn-account')
+          await server.mocker.labelProfile('porn', 'porn-profile')
+          await server.mocker.labelPost(
+            'porn',
+            await server.mocker.createImagePost('porn-posts', 'porn post'),
+          )
+          await server.mocker.labelPost(
+            'porn',
+            await server.mocker.createQuotePost(
+              'porn-posts',
+              'porn quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            'porn',
+            await server.mocker.createReply(
+              'porn-posts',
+              'porn reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.labelAccount('nudity', 'nudity-account')
+          await server.mocker.labelProfile('nudity', 'nudity-profile')
+          await server.mocker.labelPost(
+            'nudity',
+            await server.mocker.createImagePost('nudity-posts', 'nudity post'),
+          )
+          await server.mocker.labelPost(
+            'nudity',
+            await server.mocker.createQuotePost(
+              'nudity-posts',
+              'nudity quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            'nudity',
+            await server.mocker.createReply(
+              'nudity-posts',
+              'nudity reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.labelAccount('scam', 'scam-account')
+          await server.mocker.labelProfile('scam', 'scam-profile')
+          await server.mocker.labelPost(
+            'scam',
+            await server.mocker.createPost('scam-posts', 'scam post'),
+          )
+          await server.mocker.labelPost(
+            'scam',
+            await server.mocker.createQuotePost(
+              'scam-posts',
+              'scam quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            'scam',
+            await server.mocker.createReply(
+              'scam-posts',
+              'scam reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.labelAccount(
+            'not-a-real-label',
+            'unknown-account',
+          )
+          await server.mocker.labelProfile(
+            'not-a-real-label',
+            'unknown-profile',
+          )
+          await server.mocker.labelPost(
+            'not-a-real-label',
+            await server.mocker.createPost('unknown-posts', 'unknown post'),
+          )
+          await server.mocker.labelPost(
+            'not-a-real-label',
+            await server.mocker.createQuotePost(
+              'unknown-posts',
+              'unknown quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            'not-a-real-label',
+            await server.mocker.createReply(
+              'unknown-posts',
+              'unknown reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.labelAccount('!hide', 'hide-account')
+          await server.mocker.labelProfile('!hide', 'hide-profile')
+          await server.mocker.labelPost(
+            '!hide',
+            await server.mocker.createPost('hide-posts', 'hide post'),
+          )
+          await server.mocker.labelPost(
+            '!hide',
+            await server.mocker.createQuotePost(
+              'hide-posts',
+              'hide quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            '!hide',
+            await server.mocker.createReply(
+              'hide-posts',
+              'hide reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.labelAccount('!no-promote', 'no-promote-account')
+          await server.mocker.labelProfile('!no-promote', 'no-promote-profile')
+          await server.mocker.labelPost(
+            '!no-promote',
+            await server.mocker.createPost(
+              'no-promote-posts',
+              'no-promote post',
+            ),
+          )
+          await server.mocker.labelPost(
+            '!no-promote',
+            await server.mocker.createQuotePost(
+              'no-promote-posts',
+              'no-promote quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            '!no-promote',
+            await server.mocker.createReply(
+              'no-promote-posts',
+              'no-promote reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.labelAccount('!warn', 'warn-account')
+          await server.mocker.labelProfile('!warn', 'warn-profile')
+          await server.mocker.labelPost(
+            '!warn',
+            await server.mocker.createPost('warn-posts', 'warn post'),
+          )
+          await server.mocker.labelPost(
+            '!warn',
+            await server.mocker.createQuotePost(
+              'warn-posts',
+              'warn quote post',
+              anchorPost,
+            ),
+          )
+          await server.mocker.labelPost(
+            '!warn',
+            await server.mocker.createReply(
+              'warn-posts',
+              'warn reply',
+              anchorPost,
+            ),
+          )
+
+          await server.mocker.users.alice.agent.mute('muted-account.test')
+          await server.mocker.createPost('muted-account', 'muted post')
+          await server.mocker.createQuotePost(
+            'muted-account',
+            'muted quote post',
+            anchorPost,
+          )
+          await server.mocker.createReply(
+            'muted-account',
+            'muted reply',
+            anchorPost,
+          )
+
+          const list = await server.mocker.createMuteList(
+            'alice',
+            'Muted Users',
+          )
+          await server.mocker.addToMuteList(
+            'alice',
+            list,
+            server.mocker.users['muted-by-list-account'].did,
+          )
+          await server.mocker.createPost('muted-by-list-account', 'muted post')
+          await server.mocker.createQuotePost(
+            'muted-by-list-account',
+            'account quote post',
+            anchorPost,
+          )
+          await server.mocker.createReply(
+            'muted-by-list-account',
+            'account reply',
+            anchorPost,
+          )
+
+          await server.mocker.createPost('blocking-account', 'blocking post')
+          await server.mocker.createQuotePost(
+            'blocking-account',
+            'blocking quote post',
+            anchorPost,
+          )
+          await server.mocker.createReply(
+            'blocking-account',
+            'blocking reply',
+            anchorPost,
+          )
+          await server.mocker.users.alice.agent.app.bsky.graph.block.create(
+            {
+              repo: server.mocker.users.alice.did,
+            },
+            {
+              subject: server.mocker.users['blocking-account'].did,
+              createdAt: new Date().toISOString(),
+            },
+          )
+
+          await server.mocker.createPost('blockedby-account', 'blockedby post')
+          await server.mocker.createQuotePost(
+            'blockedby-account',
+            'blockedby quote post',
+            anchorPost,
+          )
+          await server.mocker.createReply(
+            'blockedby-account',
+            'blockedby reply',
+            anchorPost,
+          )
+          await server.mocker.users[
+            'blockedby-account'
+          ].agent.app.bsky.graph.block.create(
+            {
+              repo: server.mocker.users['blockedby-account'].did,
+            },
+            {
+              subject: server.mocker.users.alice.did,
+              createdAt: new Date().toISOString(),
+            },
+          )
+
+          await server.mocker.createPost(
+            'mutual-block-account',
+            'mutual-block post',
+          )
+          await server.mocker.createQuotePost(
+            'mutual-block-account',
+            'mutual-block quote post',
+            anchorPost,
+          )
+          await server.mocker.createReply(
+            'mutual-block-account',
+            'mutual-block reply',
+            anchorPost,
+          )
+          await server.mocker.users.alice.agent.app.bsky.graph.block.create(
+            {
+              repo: server.mocker.users.alice.did,
+            },
+            {
+              subject: server.mocker.users['mutual-block-account'].did,
+              createdAt: new Date().toISOString(),
+            },
+          )
+          await server.mocker.users[
+            'mutual-block-account'
+          ].agent.app.bsky.graph.block.create(
+            {
+              repo: server.mocker.users['mutual-block-account'].did,
+            },
+            {
+              subject: server.mocker.users.alice.did,
+              createdAt: new Date().toISOString(),
+            },
+          )
+
+          // flush caches
+          await server.mocker.testNet.processAll()
+        }
+      }
+      console.log('Ready')
+      return res.writeHead(200).end(server.pdsUrl)
+    } catch (e) {
+      console.error('Error!', e)
+      return res.writeHead(500).end()
+    }
+  }).listen(1986)
+  console.log('Mock server manager listening on 1986')
+}
+main()
@@ -1,3 +1,4 @@
+
 # flow.yaml

 appId: xyz.blueskyweb.app
@@ -32,7 +33,7 @@ appId: xyz.blueskyweb.app
    direction: "LEFT"
 - swipe:
    direction: "LEFT"
- swipe:
+- swipe: 
    direction: "LEFT"
 - swipe:
    direction: "RIGHT"
@@ -1,36 +1,13 @@
 appId: xyz.blueskyweb.app
 ---
 - launchApp:
-    appId: "xyz.blueskyweb.app"
-    clearState: true
-    arguments:
-      "-EXDevMenuIsOnboardingFinished": true
- runFlow:
-    when:
-      platform: iOS
-    commands:
-      - extendedWaitUntil:
-          visible: "http://localhost:8081"
-          timeout: 60000
-      - tapOn: "http://localhost:8081"
- runFlow:
-    when:
-      platform: Android
-    commands:
-      - extendedWaitUntil:
-          visible: "http://10.0.2.2:8081"
-          timeout: 60000
-      - tapOn: "http://10.0.2.2:8081"
-      - extendedWaitUntil:
-          visible: "Continue"
-          timeout: 180000
-      - tapOn: "Continue"
-      - back
+   appId: "xyz.blueskyweb.app"
+   clearState: true
+- waitForAnimationToEnd
+- tapOn: "http://localhost:8081"
+- waitForAnimationToEnd
 - extendedWaitUntil:
-    visible:
-      id: e2eProxyHeaderInput
-    timeout: 180000
- tapOn:
-    id: e2eProxyHeaderInput
- inputText: ${output.result}
- pressKey: Enter
+    visible: "Continue"
+- swipe:
+   from: "Bluesky"
+   direction: DOWN
@@ -1,8 +1,5 @@
-// eslint-disable-next-line no-undef
-var res = http.post('http://localhost:1986/' + SERVER_PATH, {
+// eslint-disable-next-line
+http.post('http://localhost:1986/' + SERVER_PATH, {
  headers: {'Content-Type': 'text/plain'},
  body: '',
 })
-
-// eslint-disable-next-line no-undef
-output.result = json(res.body).appviewDid
@@ -1,8 +1,7 @@
-import React, {type ReactNode} from 'react'
-import {FlatList, Modal, ScrollView, TextInput, View} from 'react-native'
+import React, {ReactNode} from 'react'
+import {View, ScrollView, Modal, FlatList, TextInput} from 'react-native'

 const BottomSheetModalContext = React.createContext(null)
-BottomSheetModalContext.displayName = 'BottomSheetModalContext'

 const BottomSheetModalProvider = (props: any) => {
  return <BottomSheetModalContext.Provider {...props} value={{}} />
@@ -48,13 +47,13 @@ export {useBottomSheetInternal}
 export {useBottomSheetDynamicSnapPoints}

 export {
+  BottomSheetModalProvider,
  BottomSheetBackdrop,
-  BottomSheetFlatList,
-  BottomSheetFooter,
  BottomSheetHandle,
  BottomSheetModal,
-  BottomSheetModalProvider,
+  BottomSheetFooter,
  BottomSheetScrollView,
+  BottomSheetFlatList,
  BottomSheetTextInput,
 }

@@ -0,0 +1,6 @@
+export default {
+  requestPermission: jest.fn(),
+  onForegroundEvent: jest.fn(),
+  setBadgeCount: jest.fn(),
+  displayNotification: jest.fn(),
+}
@@ -0,0 +1,9 @@
+export const CameraRoll = {
+  getPhotos: jest.fn().mockResolvedValue({
+    edges: [
+      {node: {image: {uri: 'path/to/image1.jpg'}}},
+      {node: {image: {uri: 'path/to/image2.jpg'}}},
+      {node: {image: {uri: 'path/to/image3.jpg'}}},
+    ],
+  }),
+}
@@ -1,3 +0,0 @@
-export const CID = jest.fn().mockImplementation(() => {
-  return {}
-})
@@ -1,7 +0,0 @@
-export const from = jest.fn().mockImplementation(() => {
-  return {
-    digest: jest.fn().mockImplementation(() => {
-      return Promise.resolve('')
-    }),
-  }
-})
@@ -0,0 +1,4 @@
+export default {
+  configure: jest.fn().mockResolvedValue(0),
+  finish: jest.fn(),
+}
@@ -0,0 +1 @@
+export default {}
@@ -0,0 +1,9 @@
+export const openPicker = jest
+  .fn()
+  .mockImplementation(() => Promise.resolve({uri: ''}))
+export const openCamera = jest
+  .fn()
+  .mockImplementation(() => Promise.resolve({uri: ''}))
+export const openCropper = jest
+  .fn()
+  .mockImplementation(() => Promise.resolve({uri: ''}))
@@ -0,0 +1,10 @@
+jest.mock('rn-fetch-blob', () => {
+  return {
+    __esModule: true,
+    default: {
+      fs: {
+        unlink: jest.fn(),
+      },
+    },
+  }
+})
@@ -0,0 +1,2 @@
+export const DropdownMenu = jest.fn().mockImplementation(() => {})
+export const create = jest.fn().mockImplementation(() => {})
@@ -1,12 +1,12 @@
-import {createDownloadResumable, deleteAsync} from 'expo-file-system/legacy'
+import {deleteAsync} from 'expo-file-system'
 import {manipulateAsync, SaveFormat} from 'expo-image-manipulator'
+import RNFetchBlob from 'rn-fetch-blob'

-import {IMAGE_SIZE_CONFIG_2K_1MB} from '../../src/lib/constants'
 import {
  downloadAndResize,
-  type DownloadAndResizeOpts,
+  DownloadAndResizeOpts,
+  getResizedDimensions,
 } from '../../src/lib/media/manip'
-import {getResizedDimensions} from '../../src/lib/media/util'

 const mockResizedImage = {
  path: 'file://resized-image.jpg',
@@ -32,38 +32,38 @@ describe('downloadAndResize', () => {
  })

  it('should return resized image for valid URI and options', async () => {
-    const mockedFetch = createDownloadResumable as jest.Mock
-    mockedFetch.mockReturnValue({
-      cancelAsync: jest.fn(),
-      downloadAsync: jest
-        .fn()
-        .mockResolvedValue({uri: 'file://resized-image.jpg'}),
+    const mockedFetch = RNFetchBlob.fetch as jest.Mock
+    mockedFetch.mockResolvedValueOnce({
+      path: jest.fn().mockReturnValue('file://downloaded-image.jpg'),
+      info: jest.fn().mockReturnValue({status: 200}),
+      flush: jest.fn(),
    })

    const opts: DownloadAndResizeOpts = {
      uri: 'https://example.com/image.jpg',
-      maxDimension: 2000,
+      width: 100,
+      height: 100,
      maxSize: 500000,
+      mode: 'cover',
      timeout: 10000,
    }

    const result = await downloadAndResize(opts)
    expect(result).toEqual(mockResizedImage)
-    expect(createDownloadResumable).toHaveBeenCalledWith(
-      opts.uri,
-      expect.anything(),
-      {
-        cache: true,
-      },
+    expect(RNFetchBlob.config).toHaveBeenCalledWith({
+      fileCache: true,
+      appendExt: 'jpeg',
+    })
+    expect(RNFetchBlob.fetch).toHaveBeenCalledWith(
+      'GET',
+      'https://example.com/image.jpg',
    )

    // First time it gets called is to get dimensions
    expect(manipulateAsync).toHaveBeenCalledWith(expect.any(String), [], {})
-    // The mocked source image is 100x100, below maxDimension, so it is not
-    // downsized.
    expect(manipulateAsync).toHaveBeenCalledWith(
      expect.any(String),
-      [{resize: {height: 100, width: 100}}],
+      [{resize: {height: opts.height, width: opts.width}}],
      {format: SaveFormat.JPEG, compress: 1.0},
    )
    expect(deleteAsync).toHaveBeenCalledWith(expect.any(String), {
@@ -74,8 +74,10 @@ describe('downloadAndResize', () => {
  it('should return undefined for invalid URI', async () => {
    const opts: DownloadAndResizeOpts = {
      uri: 'invalid-uri',
-      maxDimension: 2000,
+      width: 100,
+      height: 100,
      maxSize: 500000,
+      mode: 'cover',
      timeout: 10000,
    }

@@ -84,24 +86,40 @@ describe('downloadAndResize', () => {
    expect(result).toBeUndefined()
  })

+  it('should return undefined for non-200 response', async () => {
+    const mockedFetch = RNFetchBlob.fetch as jest.Mock
+    mockedFetch.mockResolvedValueOnce({
+      path: jest.fn().mockReturnValue('file://downloaded-image'),
+      info: jest.fn().mockReturnValue({status: 400}),
+      flush: jest.fn(),
+    })
+
+    const opts: DownloadAndResizeOpts = {
+      uri: 'https://example.com/image',
+      width: 100,
+      height: 100,
+      maxSize: 500000,
+      mode: 'cover',
+      timeout: 10000,
+    }
+
+    const result = await downloadAndResize(opts)
+    expect(errorSpy).not.toHaveBeenCalled()
+    expect(result).toBeUndefined()
+  })
+
  it('should not downsize whenever dimensions are below the max dimensions', () => {
    const initialDimensionsOne = {
      width: 1200,
      height: 1000,
    }
-    const resizedDimensionsOne = getResizedDimensions(
-      initialDimensionsOne,
-      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
-    )
+    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)

    const initialDimensionsTwo = {
      width: 1000,
      height: 1200,
    }
-    const resizedDimensionsTwo = getResizedDimensions(
-      initialDimensionsTwo,
-      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
-    )
+    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)

    expect(resizedDimensionsOne).toEqual(initialDimensionsOne)
    expect(resizedDimensionsTwo).toEqual(initialDimensionsTwo)
@@ -112,19 +130,13 @@ describe('downloadAndResize', () => {
      width: 3000,
      height: 1500,
    }
-    const resizedDimensionsOne = getResizedDimensions(
-      initialDimensionsOne,
-      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
-    )
+    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)

    const initialDimensionsTwo = {
      width: 2000,
      height: 4000,
    }
-    const resizedDimensionsTwo = getResizedDimensions(
-      initialDimensionsTwo,
-      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
-    )
+    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)

    expect(resizedDimensionsOne).toEqual({
      width: 2000,
@@ -1,4 +1,4 @@
-import {getLikelyType, LikelyType} from '../../src/lib/link-meta/link-meta'
+import {LikelyType, getLikelyType} from '../../src/lib/link-meta/link-meta'

 describe('getLikelyType', () => {
  it('correctly handles non-parsed url', async () => {
@@ -1,107 +0,0 @@
-import {
-  buildStateObject,
-  getCurrentRoute,
-  isStateAtTabRoot,
-} from '#/lib/routes/helpers'
-import {type State} from '#/lib/routes/types'
-
-describe('getCurrentRoute', () => {
-  it('returns Home when there is no state', () => {
-    expect(getCurrentRoute(undefined).name).toBe('Home')
-  })
-
-  it('descends into nested state using the index', () => {
-    const state = {
-      index: 0,
-      routes: [
-        {
-          name: 'HomeTab',
-          state: {
-            index: 1,
-            routes: [{name: 'Home'}, {name: 'PostThread'}],
-          },
-        },
-      ],
-    } as unknown as State
-
-    expect(getCurrentRoute(state).name).toBe('PostThread')
-  })
-
-  /*
-   * Right after a cold start from a deep link, nested navigator states are
-   * still partial and have no `index`. React Navigation focuses the last
-   * route when rehydrating such a state, so getCurrentRoute must do the
-   * same (previously it stopped at the tab route, which re-enabled the
-   * drawer swipe gesture on top of the deep-linked screen).
-   */
-  it('descends into partial nested state without an index', () => {
-    const state = {
-      routes: [
-        {
-          name: 'HomeTab',
-          state: {
-            routes: [{name: 'Home'}, {name: 'PostThread'}],
-          },
-        },
-      ],
-    } as unknown as State
-
-    expect(getCurrentRoute(state).name).toBe('PostThread')
-  })
-})
-
-describe('isStateAtTabRoot', () => {
-  it('returns true for the initial deep link state of a tab root', () => {
-    const state = buildStateObject('HomeTab', 'Home', {}) as unknown as State
-    expect(isStateAtTabRoot(state)).toBe(true)
-  })
-
-  it('returns false for the initial deep link state of a nested screen', () => {
-    const state = buildStateObject(
-      'HomeTab',
-      'PostThread',
-      {name: 'alice.test', rkey: '123'},
-      [{name: 'Home', params: {}}],
-    ) as unknown as State
-    expect(isStateAtTabRoot(state)).toBe(false)
-  })
-})
-
-describe('buildStateObject', () => {
-  it('focuses the deep-linked route in the nested state', () => {
-    const state = buildStateObject(
-      'HomeTab',
-      'PostThread',
-      {name: 'alice.test', rkey: '123'},
-      [{name: 'Home', params: {}}],
-    )
-
-    expect(state).toEqual({
-      index: 0,
-      routes: [
-        {
-          name: 'HomeTab',
-          state: {
-            index: 1,
-            routes: [
-              {name: 'Home', params: {}},
-              {name: 'PostThread', params: {name: 'alice.test', rkey: '123'}},
-            ],
-          },
-        },
-      ],
-    })
-  })
-
-  it('builds a single-route state for the Flat navigator', () => {
-    const state = buildStateObject('Flat', 'PostThread', {
-      name: 'alice.test',
-      rkey: '123',
-    })
-
-    expect(state).toEqual({
-      index: 0,
-      routes: [{name: 'PostThread', params: {name: 'alice.test', rkey: '123'}}],
-    })
-  })
-})
@@ -1,14 +1,11 @@
 import {RichText} from '@atproto/api'
-import {i18n} from '@lingui/core'

-import {parseEmbedPlayerFromUrl} from '#/lib/strings/embed-player'
+import {parseEmbedPlayerFromUrl} from 'lib/strings/embed-player'
 import {
  createStarterPackGooglePlayUri,
  createStarterPackLinkFromAndroidReferrer,
  parseStarterPackUri,
-} from '#/lib/strings/starter-pack'
-import {messages} from '#/locale/locales/en/messages'
-import {klipyUrlToBskyGifUrl} from '#/features/gifPicker/utils'
+} from 'lib/strings/starter-pack'
 import {cleanError} from '../../src/lib/strings/errors'
 import {createFullHandle, makeValidHandle} from '../../src/lib/strings/handles'
 import {enforceLen} from '../../src/lib/strings/helpers'
@@ -204,9 +201,6 @@ describe('enforceLen', () => {
 })

 describe('cleanError', () => {
-  // cleanError uses lingui
-  i18n.loadAndActivate({locale: 'en', messages})
-
  const inputs = [
    'TypeError: Network request failed',
    'Error: Aborted',
@@ -332,7 +326,6 @@ describe('shortenLinks', () => {
      expect(outputRT.text).toEqual(outputs[i][0])
      expect(outputRT.facets?.length).toEqual(outputs[i][1].length)
      for (let j = 0; j < outputs[i][1].length; j++) {
-        // @ts-expect-error whatever
        expect(outputRT.facets![j].features[0].uri).toEqual(outputs[i][1][j])
      }
    }
@@ -384,7 +377,6 @@ describe('parseEmbedPlayerFromUrl', () => {
    'https://music.apple.com/us/playlist/playlistName/playlistId',
    'https://music.apple.com/us/album/albumName/albumId',
    'https://music.apple.com/us/album/albumName/albumId?i=songId',
-    'https://music.apple.com/us/song/songName/songId',

    'https://vimeo.com/videoId',
    'https://vimeo.com/videoId?autoplay=0',
@@ -443,20 +435,6 @@ describe('parseEmbedPlayerFromUrl', () => {

    'https://www.flickr.com/groups/898944@N23/',
    'https://www.flickr.com/groups',
-
-    'https://maxblansjaar.bandcamp.com/album/false-comforts',
-    'https://grmnygrmny.bandcamp.com/track/fluid',
-    'https://sufjanstevens.bandcamp.com/',
-    'https://sufjanstevens.bandcamp.com',
-    'https://bandcamp.com/',
-    'https://bandcamp.com',
-
-    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
-    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300&mp4=videoSlugMp4&webm=videoSlugWebm',
-    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200',
-    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif',
-    'https://static.klipy.com/other/path.gif?hh=200&ww=300',
-    'https://static.klipy.com',
  ]

  const outputs = [
@@ -625,11 +603,6 @@ describe('parseEmbedPlayerFromUrl', () => {
      playerUri:
        'https://embed.music.apple.com/us/album/albumName/albumId?i=songId',
    },
-    {
-      type: 'apple_music_song',
-      source: 'appleMusic',
-      playerUri: 'https://embed.music.apple.com/us/song/songName/songId',
-    },

    {
      type: 'vimeo_video',
@@ -835,52 +808,6 @@ describe('parseEmbedPlayerFromUrl', () => {

    undefined,
    undefined,
-
-    {
-      type: 'bandcamp_album',
-      source: 'bandcamp',
-      playerUri:
-        'https://bandcamp.com/EmbeddedPlayer/url=https%3A%2F%2Fmaxblansjaar.bandcamp.com%2Falbum%2Ffalse-comforts/size=large/bgcol=ffffff/linkcol=0687f5/minimal=true/transparent=true/',
-    },
-    {
-      type: 'bandcamp_track',
-      source: 'bandcamp',
-      playerUri:
-        'https://bandcamp.com/EmbeddedPlayer/url=https%3A%2F%2Fgrmnygrmny.bandcamp.com%2Ftrack%2Ffluid/size=large/bgcol=ffffff/linkcol=0687f5/minimal=true/transparent=true/',
-    },
-    undefined,
-    undefined,
-    undefined,
-    undefined,
-
-    {
-      type: 'klipy_gif',
-      source: 'klipy',
-      isGif: true,
-      hideDetails: true,
-      playerUri: 'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif',
-      dimensions: {
-        width: 300,
-        height: 200,
-      },
-    },
-    // With video slug params — on native (test env), keeps gif filename,
-    // strips mp4/webm params. On web, would swap to video filename.
-    {
-      type: 'klipy_gif',
-      source: 'klipy',
-      isGif: true,
-      hideDetails: true,
-      playerUri: 'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif',
-      dimensions: {
-        width: 300,
-        height: 200,
-      },
-    },
-    undefined,
-    undefined,
-    undefined,
-    undefined,
  ]

  it('correctly grabs the correct id from uri', () => {
@@ -1023,20 +950,20 @@ describe('parseStarterPackHttpUri', () => {
  })

  it('returns the at uri when the input is a valid starterpack at uri', () => {
-    const validAtUri = 'at://did:plc:123/app.bsky.graph.starterpack/rkey'
+    const validAtUri = 'at://did:123/app.bsky.graph.starterpack/rkey'
    expect(parseStarterPackUri(validAtUri)).toEqual({
-      name: 'did:plc:123',
+      name: 'did:123',
      rkey: 'rkey',
    })
  })

  it('returns null when the at uri has no rkey', () => {
-    const validAtUri = 'at://did:plc:123/app.bsky.graph.starterpack'
+    const validAtUri = 'at://did:123/app.bsky.graph.starterpack'
    expect(parseStarterPackUri(validAtUri)).toEqual(null)
  })

  it('returns null when the collection is not app.bsky.graph.starterpack', () => {
-    const validAtUri = 'at://did:plc:123/app.bsky.graph.list/rkey'
+    const validAtUri = 'at://did:123/app.bsky.graph.list/rkey'
    expect(parseStarterPackUri(validAtUri)).toEqual(null)
  })

@@ -1070,31 +997,3 @@ describe('createStarterPackGooglePlayUri', () => {
    expect(createStarterPackGooglePlayUri(undefined, 'rkey')).toEqual(null)
  })
 })
-
-describe('klipyUrlToBskyGifUrl', () => {
-  const inputs = [
-    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif',
-    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
-  ]
-
-  it.each(inputs)(
-    'returns url with k.gifs.bsky.app as hostname for input url',
-    input => {
-      const out = klipyUrlToBskyGifUrl(input)
-      expect(out.startsWith('https://k.gifs.bsky.app/')).toEqual(true)
-    },
-  )
-
-  it('preserves the path and query params when rewriting', () => {
-    const out = klipyUrlToBskyGifUrl(
-      'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
-    )
-    expect(out).toEqual(
-      'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
-    )
-  })
-
-  it('returns empty string for invalid URLs', () => {
-    expect(klipyUrlToBskyGifUrl('not-a-url')).toEqual('')
-  })
-})
@@ -1,4 +1,4 @@
-import {type IsValidHandle, validateServiceHandle} from '#/lib/strings/handles'
+import {IsValidHandle, validateServiceHandle} from '#/lib/strings/handles'

 describe('handle validation', () => {
  const valid = [
@@ -18,17 +18,17 @@ describe('handle validation', () => {
  })

  const invalid = [
-    ['al', 'bsky.social', 'frontLengthNotTooShort'],
+    ['al', 'bsky.social', 'frontLength'],
    ['-alice', 'bsky.social', 'hyphenStartOrEnd'],
    ['alice-', 'bsky.social', 'hyphenStartOrEnd'],
    ['%%%', 'bsky.social', 'handleChars'],
-    ['1234567890123456789', 'bsky.social', 'frontLengthNotTooLong'],
+    ['1234567890123456789', 'bsky.social', 'frontLength'],
    [
      '1234567890123456789',
      'my-custom-pds-with-long-name.social',
-      'frontLengthNotTooLong',
+      'frontLength',
    ],
-    ['al', 'my-custom-pds-with-long-name.social', 'frontLengthNotTooShort'],
+    ['al', 'my-custom-pds-with-long-name.social', 'frontLength'],
    ['a'.repeat(300), 'toolong.com', 'totalLength'],
  ] satisfies [string, string, keyof IsValidHandle][]
  it.each(invalid)(
@@ -32,7 +32,6 @@ describe('getMentionAt', () => {
    ['@alice hello', 7, undefined],
    ['alice@alice', 0, undefined],
    ['alice@alice', 6, undefined],
-    ['hello @alice-com goodbye', 8, 'alice-com'],
  ]

  it.each(cases)(
@@ -73,7 +72,6 @@ describe('insertMentionAt', () => {
    ['@alice hello', 7, '@alice hello'],
    ['alice@alice', 0, 'alice@alice'],
    ['alice@alice', 6, 'alice@alice'],
-    ['hello @alice-com goodbye', 10, 'hello @alice.com  goodbye'],
  ]

  it.each(cases)(
@@ -1,7 +1,6 @@
 import {describe, expect, it} from '@jest/globals'

 import {
-  getChatInviteCodeFromUrl,
  isPossiblyAUrl,
  isTrustedUrl,
  linkRequiresWarning,
@@ -179,47 +178,3 @@ describe('isTrustedUrl', () => {
    expect(output).toEqual(expected)
  })
 })
-
-describe('getChatInviteCodeFromUrl', () => {
-  type Case = [string, string | undefined]
-
-  const cases: Case[] = [
-    ['https://bsky.app/chat/abcdefg', 'abcdefg'],
-    ['https://bsky.app/chat/abcdefghij', 'abcdefghij'],
-    // http is not recognized as a bsky.app url
-    ['http://bsky.app/chat/abcdefg', undefined],
-    ['https://bsky.app/chat/abcdefg?utm=foo', 'abcdefg'],
-    ['https://bsky.app/chat/abcdefg#section', 'abcdefg'],
-    ['/chat/abcdefg', 'abcdefg'],
-    ['/chat/abcdefg?utm=foo', 'abcdefg'],
-    ['/chat/abcdefg#section', 'abcdefg'],
-
-    // too short
-    ['https://bsky.app/chat/abcdef', undefined],
-    ['/chat/abcdef', undefined],
-    // too long
-    ['https://bsky.app/chat/abcdefghijk', undefined],
-    ['/chat/abcdefghijk', undefined],
-    // invalid characters
-    ['https://bsky.app/chat/abc-def', undefined],
-    ['/chat/abc def', undefined],
-    // trailing path
-    ['https://bsky.app/chat/abcdefg/extra', undefined],
-    ['/chat/abcdefg/extra', undefined],
-    // wrong path
-    ['https://bsky.app/profile/abcdefg', undefined],
-    ['https://bsky.app/chat', undefined],
-    // wrong host
-    ['https://example.com/chat/abcdefg', undefined],
-    // not a url, not a path
-    ['chat/abcdefg', undefined],
-    ['abcdefg', undefined],
-    ['', undefined],
-    // malformed url
-    ['https://[invalid/chat/abcdefg', undefined],
-  ]
-
-  it.each(cases)('given input %p, returns %p', (input, expected) => {
-    expect(getChatInviteCodeFromUrl(input)).toEqual(expected)
-  })
-})
@@ -1,11 +1,8 @@
-// @ts-check
 const pkg = require('./package.json')

-/**
- * @param {import('@expo/config-types').ExpoConfig} _config
- * @returns {{ expo: import('@expo/config-types').ExpoConfig }}
- */
-module.exports = function (_config) {
+const DARK_SPLASH_ANDROID_BACKGROUND = '#0f141b'
+
+module.exports = function (config) {
  /**
   * App version number. Should be incremented as part of a release cycle.
   */
@@ -16,11 +13,11 @@ module.exports = function (_config) {
   *
   * @see https://docs.expo.dev/build-reference/variables/#built-in-environment-variables
   */
-  const PLATFORM = process.env.EAS_BUILD_PLATFORM ?? 'web'
+  const PLATFORM = process.env.EAS_BUILD_PLATFORM

  const IS_TESTFLIGHT = process.env.EXPO_PUBLIC_ENV === 'testflight'
  const IS_PRODUCTION = process.env.EXPO_PUBLIC_ENV === 'production'
-  const IS_DEV = !IS_TESTFLIGHT && !IS_PRODUCTION
+  const IS_DEV = !IS_TESTFLIGHT || !IS_PRODUCTION

  const ASSOCIATED_DOMAINS = [
    'applinks:bsky.app',
@@ -31,16 +28,17 @@ module.exports = function (_config) {
    ...(IS_DEV || IS_TESTFLIGHT ? [] : []),
  ]

-  const UPDATES_ENABLED = IS_TESTFLIGHT || IS_PRODUCTION
+  const UPDATES_CHANNEL = IS_TESTFLIGHT
+    ? 'testflight'
+    : IS_PRODUCTION
+    ? 'production'
+    : undefined
+  const UPDATES_ENABLED = !!UPDATES_CHANNEL

  const USE_SENTRY = Boolean(process.env.SENTRY_AUTH_TOKEN)
-
-  const IOS_ICON_FILE =
-    PLATFORM === 'web' // web build doesn't like .icon files
-      ? './assets/app-icons/ios_icon_default_next.png'
-      : IS_TESTFLIGHT
-        ? './assets/app-icons/ios_icon_testflight.icon'
-        : './assets/app-icons/ios_icon_default.icon'
+  const SENTRY_DIST = `${PLATFORM}.${VERSION}.${IS_TESTFLIGHT ? 'tf' : ''}${
+    IS_DEV ? 'dev' : ''
+  }`

  return {
    expo: {
@@ -52,21 +50,17 @@ module.exports = function (_config) {
      runtimeVersion: {
        policy: 'appVersion',
      },
-      icon: './assets/app-icons/ios_icon_default_next.png',
+      icon: './assets/app-icons/ios_icon_default_light.png',
      userInterfaceStyle: 'automatic',
-      primaryColor: '#006AFF',
+      primaryColor: '#1083fe',
      ios: {
        supportsTablet: false,
        bundleIdentifier: 'xyz.blueskyweb.app',
-        appleTeamId: process.env.EXPO_APPLE_TEAM_ID,
        config: {
          usesNonExemptEncryption: false,
        },
-        icon: IOS_ICON_FILE,
        infoPlist: {
-          CADisableMinimumFrameDurationOnPhone: true,
          UIBackgroundModes: ['remote-notification'],
-          NSUserActivityTypes: ['INSendMessageIntent'],
          NSCameraUsageDescription:
            'Used for profile pictures, posts, and other kinds of content.',
          NSMicrophoneUsageDescription:
@@ -81,7 +75,6 @@ module.exports = function (_config) {
            'an',
            'ast',
            'ca',
-            'cs',
            'cy',
            'da',
            'de',
@@ -91,7 +84,6 @@ module.exports = function (_config) {
            'eu',
            'fi',
            'fr',
-            'fy',
            'ga',
            'gd',
            'gl',
@@ -107,7 +99,6 @@ module.exports = function (_config) {
            'nl',
            'pl',
            'pt-BR',
-            'pt-PT',
            'ro',
            'ru',
            'sv',
@@ -125,39 +116,8 @@ module.exports = function (_config) {
          'com.apple.developer.kernel.increased-memory-limit': true,
          'com.apple.developer.kernel.extended-virtual-addressing': true,
          'com.apple.security.application-groups': 'group.app.bsky',
-          'com.apple.developer.usernotifications.communication': true,
-          // 'com.apple.developer.device-information.user-assigned-device-name': true,
-          'com.apple.developer.declared-age-range': true,
        },
        privacyManifests: {
-          NSPrivacyCollectedDataTypes: [
-            {
-              NSPrivacyCollectedDataType: 'NSPrivacyCollectedDataTypeCrashData',
-              NSPrivacyCollectedDataTypeLinked: false,
-              NSPrivacyCollectedDataTypeTracking: false,
-              NSPrivacyCollectedDataTypePurposes: [
-                'NSPrivacyCollectedDataTypePurposeAppFunctionality',
-              ],
-            },
-            {
-              NSPrivacyCollectedDataType:
-                'NSPrivacyCollectedDataTypePerformanceData',
-              NSPrivacyCollectedDataTypeLinked: false,
-              NSPrivacyCollectedDataTypeTracking: false,
-              NSPrivacyCollectedDataTypePurposes: [
-                'NSPrivacyCollectedDataTypePurposeAppFunctionality',
-              ],
-            },
-            {
-              NSPrivacyCollectedDataType:
-                'NSPrivacyCollectedDataTypeOtherDiagnosticData',
-              NSPrivacyCollectedDataTypeLinked: false,
-              NSPrivacyCollectedDataTypeTracking: false,
-              NSPrivacyCollectedDataTypePurposes: [
-                'NSPrivacyCollectedDataTypePurposeAppFunctionality',
-              ],
-            },
-          ],
          NSPrivacyAccessedAPITypes: [
            {
              NSPrivacyAccessedAPIType:
@@ -183,17 +143,20 @@ module.exports = function (_config) {
      },
      androidStatusBar: {
        barStyle: 'light-content',
+        backgroundColor: '#00000000',
      },
      // Dark nav bar in light mode is better than light nav bar in dark mode
      androidNavigationBar: {
        barStyle: 'light-content',
+        backgroundColor: DARK_SPLASH_ANDROID_BACKGROUND,
      },
      android: {
-        icon: './assets/app-icons/android_icon_default_next.png',
+        icon: './assets/app-icons/android_icon_default_light.png',
        adaptiveIcon: {
          foregroundImage: './assets/icon-android-foreground.png',
-          monochromeImage: './assets/icon-android-monochrome.png',
-          backgroundColor: '#006AFF',
+          monochromeImage: './assets/icon-android-foreground.png',
+          backgroundImage: './assets/icon-android-background.png',
+          backgroundColor: '#1185FE',
        },
        googleServicesFile: './google-services.json',
        package: 'xyz.blueskyweb.app',
@@ -206,14 +169,10 @@ module.exports = function (_config) {
                scheme: 'https',
                host: 'bsky.app',
              },
-              ...(IS_DEV
-                ? [
-                    {
-                      scheme: 'http',
-                      host: 'localhost:19006',
-                    },
-                  ]
-                : []),
+              IS_DEV && {
+                scheme: 'http',
+                host: 'localhost:19006',
+              },
            ],
            category: ['BROWSABLE', 'DEFAULT'],
          },
@@ -236,48 +195,32 @@ module.exports = function (_config) {
            }
          : undefined,
        checkAutomatically: 'NEVER',
+        channel: UPDATES_CHANNEL,
      },
      plugins: [
        'expo-video',
        'expo-localization',
-        'expo-web-browser',
-        [
-          'react-native-edge-to-edge',
-          {android: {enforceNavigationBarContrast: false}},
+        USE_SENTRY && [
+          '@sentry/react-native/expo',
+          {
+            organization: 'blueskyweb',
+            project: 'react-native',
+            release: VERSION,
+            dist: SENTRY_DIST,
+          },
        ],
-        ...(USE_SENTRY
-          ? [
-              /** @type {[string, any]} */ ([
-                '@sentry/react-native/expo',
-                {
-                  organization: 'blueskyweb',
-                  project: 'app',
-                  url: 'https://sentry.io',
-                },
-              ]),
-            ]
-          : []),
        [
          'expo-build-properties',
          {
            ios: {
              deploymentTarget: '15.1',
-              buildReactNativeFromSource: true,
-              ccacheEnabled: IS_DEV,
-              cxxLanguageStandard: 'c++23',
-              extraPods: [
-                {
-                  name: 'MCEmojiPicker',
-                  git: 'https://github.com/bluesky-social/MCEmojiPicker.git',
-                  branch: 'main',
-                },
-              ],
+              newArchEnabled: false,
            },
            android: {
-              compileSdkVersion: 36,
+              compileSdkVersion: 35,
              targetSdkVersion: 35,
              buildToolsVersion: '35.0.0',
-              buildReactNativeFromSource: IS_PRODUCTION,
+              newArchEnabled: false,
            },
          },
        ],
@@ -298,13 +241,15 @@ module.exports = function (_config) {
        ],
        './plugins/starterPackAppClipExtension/withStarterPackAppClip.js',
        './plugins/withGradleJVMHeapSizeIncrease.js',
-        './plugins/withAndroidManifestLargeHeapPlugin.js',
+        './plugins/withAndroidManifestPlugin.js',
        './plugins/withAndroidManifestFCMIconPlugin.js',
-        './plugins/withAndroidManifestIntentQueriesPlugin.js',
        './plugins/withAndroidStylesAccentColorPlugin.js',
+        './plugins/withAndroidSplashScreenStatusBarTranslucentPlugin.js',
        './plugins/withAndroidNoJitpackPlugin.js',
+        './plugins/withNoBundleCompression.js',
        './plugins/shareExtension/withShareExtensions.js',
        './plugins/notificationsExtension/withNotificationsExtension.js',
+        './plugins/withAppDelegateReferrer.js',
        [
          'expo-font',
          {
@@ -314,12 +259,10 @@ module.exports = function (_config) {
              // Android only
              './assets/fonts/inter/Inter-Regular.otf',
              './assets/fonts/inter/Inter-Italic.otf',
-              './assets/fonts/inter/Inter-Medium.otf',
-              './assets/fonts/inter/Inter-MediumItalic.otf',
              './assets/fonts/inter/Inter-SemiBold.otf',
              './assets/fonts/inter/Inter-SemiBoldItalic.otf',
-              './assets/fonts/inter/Inter-Bold.otf',
-              './assets/fonts/inter/Inter-BoldItalic.otf',
+              './assets/fonts/inter/Inter-ExtraBold.otf',
+              './assets/fonts/inter/Inter-ExtraBoldItalic.otf',
            ],
          },
        ],
@@ -327,43 +270,43 @@ module.exports = function (_config) {
          'expo-splash-screen',
          {
            ios: {
-              enableFullScreenImage_legacy: true, // iOS only
-              backgroundColor: '#006AFF', // primary_500
-              image: './assets/splash/splash.png',
+              enableFullScreenImage_legacy: true,
+              backgroundColor: '#ffffff',
+              image: './assets/splash.png',
              resizeMode: 'cover',
              dark: {
-                enableFullScreenImage_legacy: true, // iOS only
-                backgroundColor: '#002861', // primary_900
-                image: './assets/splash/splash-dark.png',
+                enableFullScreenImage_legacy: true,
+                backgroundColor: '#001429',
+                image: './assets/splash-dark.png',
                resizeMode: 'cover',
              },
            },
            android: {
-              backgroundColor: '#006AFF', // primary_500
-              image: './assets/splash/android-splash-logo-white.png',
-              imageWidth: 102, // even division of 306px
+              backgroundColor: '#0c7cff',
+              image: './assets/splash-android-icon.png',
+              imageWidth: 150,
              dark: {
-                backgroundColor: '#002861', // primary_900
-                image: './assets/splash/android-splash-logo-white.png',
-                imageWidth: 102,
+                backgroundColor: '#0c2a49',
+                image: './assets/splash-android-icon-dark.png',
+                imageWidth: 150,
              },
            },
          },
        ],
        [
-          '@bsky.app/expo-dynamic-app-icon',
+          '@mozzius/expo-dynamic-app-icon',
          {
            /**
             * Default set
             */
            default_light: {
-              ios: './assets/app-icons/ios_icon_legacy_light.png',
-              android: './assets/app-icons/android_icon_legacy_light.png',
+              ios: './assets/app-icons/ios_icon_default_light.png',
+              android: './assets/app-icons/android_icon_default_light.png',
              prerendered: true,
            },
            default_dark: {
-              ios: './assets/app-icons/ios_icon_legacy_dark.png',
-              android: './assets/app-icons/android_icon_legacy_dark.png',
+              ios: './assets/app-icons/ios_icon_default_dark.png',
+              android: './assets/app-icons/android_icon_default_dark.png',
              prerendered: true,
            },

@@ -418,15 +361,17 @@ module.exports = function (_config) {
          },
        ],
        ['expo-screen-orientation', {initialOrientation: 'PORTRAIT_UP'}],
-        ['expo-location'],
        [
-          'expo-contacts',
+          'react-native-vision-camera',
          {
-            contactsPermission:
-              'I agree to allow Bluesky to use my contacts for friend discovery until I opt out.',
+            enableLocation: false,
+            cameraPermissionText: 'Bluesky needs access to your camera.',
+            enableMicrophonePermission: true,
+            microphonePermissionText:
+              'Bluesky needs access to your microphone.',
          },
        ],
-      ],
+      ].filter(Boolean),
      extra: {
        eas: {
          build: {
@@ -462,6 +407,22 @@ module.exports = function (_config) {
          projectId: '55bd077a-d905-4184-9c7f-94789ba0f302',
        },
      },
+      hooks: {
+        postPublish: [
+          /*
+           * @see https://docs.expo.dev/guides/using-sentry/#app-configuration
+           */
+          {
+            file: './postHooks/uploadSentrySourcemapsPostHook',
+            config: {
+              organization: 'blueskyweb',
+              project: 'react-native',
+              release: VERSION,
+              dist: SENTRY_DIST,
+            },
+          },
+        ],
+      },
    },
  }
 }
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`alt-blur@3076a2b5a593b0d7b37198b5aebfe3a222afd52d`
@@ -1 +1 @@
 .18.0